From 70ea950468310d63d81ee1f4b19ab6c98dc0a7cd Mon Sep 17 00:00:00 2001
From: Sumit Bose <sbose@redhat.com>
Date: Fri, 14 Jun 2024 19:52:58 +0200
Subject: [PATCH] man: add details for ad_access_filter

Mentioned explicitly that GPO based access control must be disabled if
ad_access_filter based access control should be the only access control.

Reviewed-by: Dan Lavu <dlavu@redhat.com>
(cherry picked from commit 71160e350999d0aa058bf98f05d7928f08f2b449)
---
 src/man/sssd-ad.5.xml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/man/sssd-ad.5.xml b/src/man/sssd-ad.5.xml
index 0a183d729af..247d023892f 100644
--- a/src/man/sssd-ad.5.xml
+++ b/src/man/sssd-ad.5.xml
@@ -263,7 +263,12 @@ ad_enabled_domains = sales.example.com, eng.example.com
                             to be allowed access. Please note that the
                             <quote>access_provider</quote> option must be
                             explicitly set to <quote>ad</quote> in order
-                            for this option to have an effect.
+                            for this option to have an effect. Additionally,
+                            please note that the default access control is the
+                            GPO based access control which must be disabled
+                            explicitly if <quote>ad_access_filter</quote> should
+                            be the only access control scheme (see option
+                            <quote>ad_gpo_access_control</quote> for details).
                         </para>
                         <para>
                             The option also supports specifying different