Updating translation for the 1.11.2 releasesssd-1_11_2

15 files changed, 3694 insertions, 2244 deletions

diff --git a/src/man/po/br.po b/src/man/po/br.po
index 7932e0553..bb63b3129 100644
--- a/src/man/po/br.po
+++ b/src/man/po/br.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
 "Language-Team: Breton (http://www.transifex.com/projects/p/fedora/language/"
@@ -440,7 +440,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -499,8 +499,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Dre ziouer : true"
 
@@ -519,7 +519,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -2019,7 +2019,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2063,7 +2063,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2322,7 +2322,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr ""
 
@@ -2498,7 +2498,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -4003,7 +4003,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4056,7 +4056,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4068,12 +4068,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4083,7 +4083,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4963,13 +4963,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
@@ -5410,7 +5410,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5425,7 +5425,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5440,12 +5440,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5466,12 +5466,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5513,12 +5513,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5526,12 +5526,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5550,19 +5550,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5653,7 +5653,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5665,7 +5665,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6273,9 +6273,79 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: true"
+msgid "Default: Not set"
+msgstr "Dre ziouer : true"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6285,29 +6355,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6315,7 +6385,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6330,7 +6400,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6339,7 +6409,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6347,7 +6417,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7104,106 +7174,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7216,7 +7282,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7225,7 +7291,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7235,19 +7301,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: root"
 msgid "Default: (from libkrb5)"
 msgstr "Dre zoiuer : root"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7255,7 +7321,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7266,36 +7332,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7303,91 +7369,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7395,55 +7461,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7451,24 +7517,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7483,7 +7549,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7492,7 +7558,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8603,104 +8669,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/ca.po b/src/man/po/ca.po
index 0b3aea339..0d744adc0 100644
--- a/src/man/po/ca.po
+++ b/src/man/po/ca.po
@@ -10,10 +10,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
-"Language-Team: Catalan <fedora@llistes.softcatala.org>\n"
+"Language-Team: Catalan (http://www.transifex.com/projects/p/fedora/language/"
+"ca/)\n"
 "Language: ca\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -483,7 +484,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -552,8 +553,8 @@ msgstr "Afegir una marca de temps als missatges de depuració"
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Per defecte: true"
 
@@ -572,7 +573,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "Per defecte: false"
 
@@ -2187,7 +2188,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Per defecte: 6"
 
@@ -2233,7 +2234,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2522,7 +2523,7 @@ msgstr "Per defecte: Cap, no s'executa cap comanda"
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "EXEMPLE"
 
@@ -2743,7 +2744,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -4347,7 +4348,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr "Especifica el temps de vida en segons de la TGT si s'utilitza GSSAPI."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "Per defecte: 86400 (24 hores)"
 
@@ -4409,7 +4410,7 @@ msgstr ""
 "krb5.conf</filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4421,12 +4422,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4436,7 +4437,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -5379,13 +5380,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTES"
@@ -5912,7 +5913,7 @@ msgstr ""
 "complet utilitzat en el domini d'IPA per identificar aquest amfitrió."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5927,7 +5928,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5942,12 +5943,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5968,12 +5969,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -6015,12 +6016,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -6028,12 +6029,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -6052,19 +6053,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -6155,7 +6156,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr "krb5_validate (booleà)"
 
@@ -6169,7 +6170,7 @@ msgstr ""
 "suplantada."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6787,9 +6788,81 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+#, fuzzy
+#| msgid "ldap_access_filter (string)"
+msgid "ad_access_filter (boolean)"
+msgstr "ldap_access_filter (cadena)"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: true"
+msgid "Default: Not set"
+msgstr "Per defecte: true"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6799,29 +6872,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6829,7 +6902,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6844,7 +6917,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6853,7 +6926,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6861,7 +6934,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7697,106 +7770,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7809,7 +7878,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7818,7 +7887,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7828,19 +7897,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "Per defecte: 0 (sense límit)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7848,7 +7917,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7859,36 +7928,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7896,91 +7965,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7988,55 +8057,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -8044,24 +8113,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -8076,7 +8145,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -8085,7 +8154,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -9196,106 +9265,122 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
 msgstr ""
 
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+#, fuzzy
+#| msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
+msgid "<emphasis>Default</emphasis>: 0"
+msgstr "<emphasis>filter</emphasis>: utilitza ldap_access_filter"
+
 #. type: Content of: outside any tag (error?)
 #: include/experimental.xml:1
 msgid ""
diff --git a/src/man/po/cs.po b/src/man/po/cs.po
index a8ba43760..75028dd0a 100644
--- a/src/man/po/cs.po
+++ b/src/man/po/cs.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2012-05-22 13:44+0000\n"
 "Last-Translator: sgallagh <sgallagh@redhat.com>\n"
 "Language-Team: Czech (http://www.transifex.com/projects/p/fedora/language/"
@@ -435,7 +435,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -494,8 +494,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -514,7 +514,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -2012,7 +2012,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2056,7 +2056,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2315,7 +2315,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr ""
 
@@ -2491,7 +2491,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -3996,7 +3996,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4049,7 +4049,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4061,12 +4061,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4076,7 +4076,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4956,13 +4956,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
@@ -5425,7 +5425,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5440,7 +5440,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5455,12 +5455,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5481,12 +5481,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5528,12 +5528,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5541,12 +5541,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5565,19 +5565,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5668,7 +5668,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5680,7 +5680,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6288,9 +6288,77 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+msgid "Default: Not set"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6300,29 +6368,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6330,7 +6398,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6345,7 +6413,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6354,7 +6422,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6362,7 +6430,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7119,106 +7187,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7231,7 +7295,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7240,7 +7304,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7250,17 +7314,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 msgid "Default: (from libkrb5)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7268,7 +7332,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7279,36 +7343,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7316,91 +7380,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7408,55 +7472,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7464,24 +7528,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7496,7 +7560,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7505,7 +7569,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8637,104 +8701,118 @@ msgstr "<option>-h</option>,<option>--help</option>"
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/es.po b/src/man/po/es.po
index 65dc3c850..51f3c1547 100644
--- a/src/man/po/es.po
+++ b/src/man/po/es.po
@@ -15,10 +15,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
-"Language-Team: Spanish <trans-es@lists.fedoraproject.org>\n"
+"Language-Team: Spanish (http://www.transifex.com/projects/p/fedora/language/"
+"es/)\n"
 "Language: es\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -519,7 +520,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr "Predeterminado: no definido"
@@ -588,8 +589,8 @@ msgstr "Agregar una marca de tiempo a los mensajes de depuración"
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Predeterminado: true"
 
@@ -608,7 +609,7 @@ msgstr "Agregar microsegundos a la marca de tiempo en mensajes de depuración"
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "Predeterminado: false"
 
@@ -2409,7 +2410,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Predeterminado: 6"
 
@@ -2458,7 +2459,7 @@ msgstr ""
 "momento,  esta opción no está soportada en el proveedor local."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr "Predeterminado: True"
 
@@ -2760,7 +2761,7 @@ msgstr "Predeterminado: None, no se ejecuta comando"
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "EJEMPLO"
 
@@ -2996,7 +2997,7 @@ msgstr ""
 "http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr "Ejemplos:"
 
@@ -4735,7 +4736,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr "Especifica el tiempo de vida en segundos del TGT si se usa GSSAPI."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "Predeterminado: 86400 (24 horas)"
 
@@ -4804,7 +4805,7 @@ msgstr ""
 "filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (boolean)"
 
@@ -4818,12 +4819,12 @@ msgstr ""
 "servidor LDAP. Esta función está disponible con MIT Kerberos >= 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4833,7 +4834,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -5885,13 +5886,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTAS"
@@ -6489,7 +6490,7 @@ msgstr ""
 "host."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -6504,7 +6505,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -6522,12 +6523,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -6548,12 +6549,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Por defecto: 1200 (segundos)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -6595,12 +6596,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -6608,12 +6609,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -6632,19 +6633,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -6747,7 +6748,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr "Por defecto: el valor de <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr "krb5_validate (boolean)"
 
@@ -6760,7 +6761,7 @@ msgstr ""
 "Verifica con la ayuda de krb5_keytab que el TGT obtenido no ha sido burlado."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -7457,9 +7458,81 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+#, fuzzy
+#| msgid "ldap_sudo_use_host_filter (boolean)"
+msgid "ad_access_filter (boolean)"
+msgstr "ldap_sudo_use_host_filter (booleano)"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: not set"
+msgid "Default: Not set"
+msgstr "Predeterminado: no definido"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -7469,29 +7542,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -7502,7 +7575,7 @@ msgstr ""
 "Este ejemplo muestra sólo las opciones específicas del proveedor AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -7526,7 +7599,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7538,7 +7611,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -7549,7 +7622,7 @@ msgstr ""
 "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -8516,106 +8589,102 @@ msgstr "krb5_ccachedir (cadena)"
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr "Predeterminado: /tmp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr "krb5_ccname_template (string)"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr "%u"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr "nombre de acceso"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr "%U"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr "UID de acceso"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr "%p"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr "nombre principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr "%r"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr "nombre de reino"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr "%h"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr "directorio home"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr "%d"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr "valor de krb5ccache_dir"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr "%P"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr "%%"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr "un literal ‘%’"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -8628,7 +8697,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -8637,7 +8706,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -8647,19 +8716,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "Predeterminado: 0 (Sin límite)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr "krb5_auth_timeout (entero)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -8667,7 +8736,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -8678,12 +8747,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr "krb5_keytab (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
@@ -8692,24 +8761,24 @@ msgstr ""
 "validadas desde KDCs."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr "Predeterminado: /etc/krb5.keytab"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr "krb5_store_password_if_offline (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -8717,80 +8786,80 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr "krb5_renewable_lifetime (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr "Por defecto: no fijado, esto es el TGT no es renovable"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr "krb5_lifetime (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
@@ -8798,12 +8867,12 @@ msgstr ""
 "configurado en el KDC."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -8811,17 +8880,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr "krb5_use_fast (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
@@ -8830,38 +8899,38 @@ msgstr ""
 "autenticación Kerberos. Se soportan las siguientes opciones:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr "Por defecto: no fijado, esto es no se usa FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -8869,24 +8938,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr "krb5_fast_principal (cadena)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr "Especifica el servidor principal para usar por FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -8901,7 +8970,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -8910,7 +8979,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -10310,108 +10379,152 @@ msgstr "<option>-h</option>,<option>--help</option>"
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
-"Bit de máscara que indica que niveles de depuración serán visibles. 0x0010 "
-"es el valor por defecto así como el valor más bajo permitido, 0xFFF0 es el "
-"modo más verboso. Este ajuste anula los ajustes del fichero de configuración."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr "Niveles de depuración actualmente soportados:"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
+#| "SSSD from starting up or causes it to cease running."
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 "<emphasis>0x0010</emphasis>: Fallos fatales. Cualquier cosa que evitaría que "
 "SSSD arrancara u origine el cese de la ejecución."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't "
+#| "kill the SSSD, but one that indicates that at least one major feature is "
+#| "not going to work properly."
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 "<emphasis>0x0020</emphasis>: Fallos críticos. Un error que no matará SSSD, "
 "pero que indica que al menos una de las funciones principales no está "
 "trabajando apropiadamente."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
+#| "particular request or operation has failed."
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 "<emphasis>0x0040</emphasis>: Fallos serios. Un error anunciando que una "
 "petición u operación concreta ha fallado."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0080</emphasis>: Minor failures. These are the errors that "
+#| "would percolate down to cause the operation failure of 2."
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 "<emphasis>0x0080</emphasis>: Fallos menores. Estos son errores que podrían "
 "filtrarse hacia abajo para causar fallos en la operación de 2."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+#, fuzzy
+#| msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr "<emphasis>0x0100</emphasis>: Ajustes de configuración."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+#, fuzzy
+#| msgid "<emphasis>0x0200</emphasis>: Function data."
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr "<emphasis>0x0200</emphasis>: Datos de función."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+#, fuzzy
+#| msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 "<emphasis>0x0400</emphasis>: Traza de mensajes para funciones de operación."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x1000</emphasis>: Trace messages for internal control "
+#| "functions."
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 "<emphasis>0x1000</emphasis>: Traza de mensajes para funciones de control "
 "interno."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
+#| "may be interesting."
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 "<emphasis>0x2000</emphasis>: Contenidos de variables de función interna que "
 "pueden ser interesantes."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 "<emphasis>0x4000</emphasis>: Información de trazado de nivel extremadamente "
 "bajo."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
+#, fuzzy
+#| msgid ""
+#| "To log required debug levels, simply add their numbers together as shown "
+#| "in following examples:"
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 "Para registrar los niveles de depuración requeridos, simplemente añada sus "
 "números juntos como se muestra en los siguientes ejemplos:"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
@@ -10420,7 +10533,7 @@ msgstr ""
 "serios y datos de función use 0x0270."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
@@ -10430,15 +10543,26 @@ msgstr ""
 "interno use 0x1310."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
+#, fuzzy
+#| msgid ""
+#| "<emphasis>Note</emphasis>: This is new format of debug levels introduced "
+#| "in 1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
 msgstr ""
 "<emphasis>Nota</emphasis>: Este es un nuevo formato de niveles de depuración "
 "introducido en 1.7.0. El formato más antiguo (números de 0-10) es compatible "
 "pero obsoleto."
 
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+#, fuzzy
+#| msgid "<emphasis>filter</emphasis>: use ldap_access_filter"
+msgid "<emphasis>Default</emphasis>: 0"
+msgstr "<emphasis>filtro</emphasis>: utilizar ldap_access_filter"
+
 #. type: Content of: outside any tag (error?)
 #: include/experimental.xml:1
 msgid ""
@@ -10665,3 +10789,13 @@ msgstr "Por defecto: No fijado (SSSD usará el valor recuperado desde LDAP)"
 
 #~ msgid "Default: FILE:%d/krb5cc_%U_XXXXXX"
 #~ msgstr "Predeterminado: FILE:%d/krb5cc_%U_XXXXXX"
+
+#~ msgid ""
+#~ "Bit mask that indicates which debug levels will be visible. 0x0010 is the "
+#~ "default value as well as the lowest allowed value, 0xFFF0 is the most "
+#~ "verbose mode. This setting overrides the settings from config file."
+#~ msgstr ""
+#~ "Bit de máscara que indica que niveles de depuración serán visibles. "
+#~ "0x0010 es el valor por defecto así como el valor más bajo permitido, "
+#~ "0xFFF0 es el modo más verboso. Este ajuste anula los ajustes del fichero "
+#~ "de configuración."
diff --git a/src/man/po/eu.po b/src/man/po/eu.po
index 61364df31..2cf079e84 100644
--- a/src/man/po/eu.po
+++ b/src/man/po/eu.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: sssd-docs 1.8.95\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2012-07-18 21:31+0300\n"
 "Last-Translator: Automatically generated\n"
 "Language-Team: none\n"
@@ -432,7 +432,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -491,8 +491,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -511,7 +511,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -2009,7 +2009,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2053,7 +2053,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2312,7 +2312,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr ""
 
@@ -2488,7 +2488,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -3993,7 +3993,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4046,7 +4046,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4058,12 +4058,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4073,7 +4073,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4953,13 +4953,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
@@ -5400,7 +5400,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5415,7 +5415,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5430,12 +5430,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5456,12 +5456,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5503,12 +5503,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5516,12 +5516,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5540,19 +5540,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5643,7 +5643,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5655,7 +5655,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6263,9 +6263,77 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+msgid "Default: Not set"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6275,29 +6343,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6305,7 +6373,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6320,7 +6388,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6329,7 +6397,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6337,7 +6405,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7094,106 +7162,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7206,7 +7270,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7215,7 +7279,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7225,17 +7289,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 msgid "Default: (from libkrb5)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7243,7 +7307,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7254,36 +7318,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7291,91 +7355,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7383,55 +7447,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7439,24 +7503,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7471,7 +7535,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7480,7 +7544,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8591,104 +8655,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/fr.po b/src/man/po/fr.po
index 797a0fce7..5a025db8b 100644
--- a/src/man/po/fr.po
+++ b/src/man/po/fr.po
@@ -10,10 +10,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-29 13:10+0000\n"
 "Last-Translator: Jérôme Fenal <jfenal@gmail.com>\n"
-"Language-Team: French <trans-fr@lists.fedoraproject.org>\n"
+"Language-Team: French (http://www.transifex.com/projects/p/fedora/language/"
+"fr/)\n"
 "Language: fr\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -532,7 +533,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr "Par défaut : non défini"
@@ -601,8 +602,8 @@ msgstr "Ajoute un horodatage aux messages de débogage"
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Par défaut : true"
 
@@ -621,7 +622,7 @@ msgstr "Ajouter les microsecondes à l'horodatage dans les messages de débogage
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "Par défaut : false"
 
@@ -2479,7 +2480,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Par défaut : 6"
 
@@ -2529,7 +2530,7 @@ msgstr ""
 "Actuellement, cette option n'est pas supportée dans le fournisseur local."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr "Par défaut : True"
 
@@ -2838,7 +2839,7 @@ msgstr "Par défaut : None, aucune commande lancée"
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "EXEMPLE"
 
@@ -3077,7 +3078,7 @@ msgstr ""
 "http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr "Exemples :"
 
@@ -4848,7 +4849,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr "Définit la durée de vie, en secondes, des TGT si GSSAPI est utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "Par défaut : 86400 (24 heures)"
 
@@ -4918,7 +4919,7 @@ msgstr ""
 "filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (booléen)"
 
@@ -4933,12 +4934,12 @@ msgstr ""
 "Kerberos > = 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4953,7 +4954,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -6015,13 +6016,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTES"
@@ -6625,7 +6626,7 @@ msgstr ""
 "identifier l'hôte."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (booléen)"
 
@@ -6645,7 +6646,7 @@ msgstr ""
 "l'utilisation de l'option <quote>dyndns_iface</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -6667,12 +6668,12 @@ msgstr ""
 "configuration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -6699,12 +6700,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Par défaut : 1200 (secondes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -6761,12 +6762,12 @@ msgstr ""
 "seront utilisés comme serveurs de repli"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -6778,12 +6779,12 @@ msgstr ""
 "configurée à true."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -6808,12 +6809,12 @@ msgid "Default: False (disabled)"
 msgstr "Par défaut : False (désactivé)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -6822,7 +6823,7 @@ msgstr ""
 "communication avec le serveur DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Par défaut : False (laisser nsupdate choisir le protocole)"
 
@@ -6928,7 +6929,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr "Par défaut : la valeur de <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr "krb5_validate (booléen)"
 
@@ -6940,7 +6941,7 @@ msgid ""
 msgstr "Vérifie avec l'aide de krb5_keytab que le TGT obtenu n'est pas usurpé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -7685,9 +7686,81 @@ msgstr ""
 "configuration SRV du DNS, incluant la découverte de domaine, est aussi "
 "utilisée pendant la découverte de site."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+#, fuzzy
+#| msgid "ad_enable_dns_sites (boolean)"
+msgid "ad_access_filter (boolean)"
+msgstr "ad_enable_dns_sites (booléen)"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: not set"
+msgid "Default: Not set"
+msgstr "Par défaut : non défini"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -7704,22 +7777,22 @@ msgstr ""
 "<quote>dyndns_iface</quote>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr "Par défaut : 3600 (secondes)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr "Par défaut : utilise l'adresse IP de la connexion LDAP AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr "krb5_use_enterprise_principal (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
@@ -7729,7 +7802,7 @@ msgstr ""
 "principals d'entreprise."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -7740,7 +7813,7 @@ msgstr ""
 "exemples montrent seulement les options spécifiques au fournisseur AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -7764,7 +7837,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7776,7 +7849,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -7787,7 +7860,7 @@ msgstr ""
 "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -8778,114 +8851,102 @@ msgstr "krb5_ccachedir (chaîne)"
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
-msgstr ""
-"Répertoire pour stocker les caches crédits. Toutes les séquences de "
-"substitution de krb5_ccname_template peuvent être utilisée ici, hormis %d et "
-"%P. Si le dossier n'existe pas, il sera créé. Si %u, %U, %p ou %h sont "
-"utilisés, un répertoire privé appartenant à l'utilisateur est créé. Sinon un "
-"répertoire public avec un drapeau de restriction à la suppression (aussi "
-"appelé « sticky bit », cf. <citerefentry> <refentrytitle>chmod</"
-"refentrytitle> <manvolnum>1</manvolnum> </citerefentry> pour plus de "
-"détails) est créé."
-
-#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr "Par défaut : /tmp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr "krb5_ccname_template (chaîne)"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr "%u"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr "identifiant de connexion"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr "%U"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr "UID de l'utilisateur"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr "%p"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr "nom du principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr "%r"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr "nom de domaine"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr "%h"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr "répertoire personnel"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr "%d"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr "valeur de krb5ccache_dir"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr "%P"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr "l'ID de processus du client SSSD"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr "%%"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr "un « % » littéral"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 #, fuzzy
 #| msgid ""
 #| "Location of the user's credential cache. Two credential cache types are "
@@ -8915,7 +8976,7 @@ msgstr ""
 "unique en toute sécurité."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -8924,7 +8985,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -8934,19 +8995,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "Par défaut : 0 (pas de limite)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr "krb5_auth_timeout (entier)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -8957,7 +9018,7 @@ msgstr ""
 "d'authentification sera effectuée hors-ligne si cela est possible."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -8976,12 +9037,12 @@ msgstr ""
 "keytab."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr "krb5_keytab (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
@@ -8990,17 +9051,17 @@ msgstr ""
 "d'identification obtenues à partir de KDC."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr "Par défaut : /etc/krb5.keytab"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr "krb5_store_password_if_offline (booléen)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
@@ -9010,7 +9071,7 @@ msgstr ""
 "disponible en ligne."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -9022,12 +9083,12 @@ msgstr ""
 "accessibles à l'utilisateur root (avec difficulté)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr "krb5_renewable_lifetime (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
@@ -9036,32 +9097,32 @@ msgstr ""
 "entier immédiatement suivi par une unité de temps :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr "<emphasis>s</emphasis> pour secondes"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr "<emphasis>m</emphasis> pour minutes"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr "<emphasis>h</emphasis> pour heures"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr "<emphasis>d</emphasis> pour jours."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr "Si aucune unité n'est spécifiée, <emphasis>s</emphasis> est utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
@@ -9071,18 +9132,18 @@ msgstr ""
 "de « 1h30m »."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 "Par défaut : non défini, c'est-à-dire que le TGT n'est pas renouvelable"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr "krb5_lifetime (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
@@ -9091,12 +9152,12 @@ msgstr ""
 "suivi par une unité de temps :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr "Si aucune unité n'est spécifiée, <emphasis>s</emphasis> est utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
@@ -9105,7 +9166,7 @@ msgstr ""
 "de vie de une heure et trente minutes, utiliser « 90m » au lieu de « 1h30m »."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
@@ -9113,12 +9174,12 @@ msgstr ""
 "dans le KDC."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr "krb5_renew_interval (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -9130,19 +9191,19 @@ msgstr ""
 "de temps :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 "Si cette option n'est pas définie ou définie à 0, le renouvellement "
 "automatique est désactivé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr "krb5_use_fast (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
@@ -9151,7 +9212,7 @@ msgstr ""
 "authentification Kerberos. Les options suivantes sont supportées :"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
@@ -9160,7 +9221,7 @@ msgstr ""
 "cette option."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
@@ -9169,7 +9230,7 @@ msgstr ""
 "charge FAST, continuer l'authentification sans."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
@@ -9178,17 +9239,17 @@ msgstr ""
 "le serveur ne requiert pas FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr "Par défaut : non défini, i.e. FAST n'est pas utilisé."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr "NOTE : un fichier keytab est requis pour utiliser FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -9199,17 +9260,17 @@ msgstr ""
 "MIT Kerberos avec cette option est une erreur de configuration."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr "krb5_fast_principal (chaîne)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr "Spécifie le principal de serveur afin d'utiliser FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
@@ -9219,7 +9280,7 @@ msgstr ""
 "et versions suivantes."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr "Par défaut : false (AD provide: true)"
 
@@ -9240,7 +9301,7 @@ msgstr ""
 "\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -9253,7 +9314,7 @@ msgstr ""
 "et n'inclut aucun fournisseur d'identité."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -10667,105 +10728,148 @@ msgstr "<option>-h</option>,<option>--help</option>"
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
-"Un masque de bits qui indique quels niveaux de débogage seront visibles. 0 x "
-"0010 est la valeur par défaut ainsi que la plus basse autorisée, 0xFFF0 est "
-"le mode le plus détaillé. Ce paramètre prend le pas sur les paramètres du "
-"fichier de configuration."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr "Niveaux de débogage actuellement pris en charge :"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
+#| "SSSD from starting up or causes it to cease running."
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 "<emphasis>0x0010</emphasis> : défaillances fatales. Tout ce qui empêcherait "
 "SSSD de démarrer ou provoquerait son arrêt."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't "
+#| "kill the SSSD, but one that indicates that at least one major feature is "
+#| "not going to work properly."
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 "<emphasis>0x0020</emphasis> : échecs critiques. Une erreur qui ne tue pas "
 "SSSD, mais qui indique qu'au moins une caractéristique majeure ne pourra pas "
 "fonctionner correctement."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
+#| "particular request or operation has failed."
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 "<emphasis>0x0040</emphasis> : défaillances graves. Une erreur qui annonce "
 "qu'une requête particulière ou une opération a échoué."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0080</emphasis>: Minor failures. These are the errors that "
+#| "would percolate down to cause the operation failure of 2."
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 "<emphasis>0x0080</emphasis> : erreurs mineures. Ce sont les erreurs qui "
 "seraient susceptibles d'empirer pour provoquer l'erreur en 2."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+#, fuzzy
+#| msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr "<emphasis>0x0100</emphasis> : paramètres de configuration."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+#, fuzzy
+#| msgid "<emphasis>0x0200</emphasis>: Function data."
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr "<emphasis>0x0200</emphasis> : données de fonctionnement."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+#, fuzzy
+#| msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr "<emphasis>0x0400</emphasis> : traçage des fonctions opérationnelles."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x1000</emphasis>: Trace messages for internal control "
+#| "functions."
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 "<emphasis>0x1000</emphasis> : traçage des fonctions de contrôles internes."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
+#| "may be interesting."
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 "<emphasis>0x2000</emphasis> :  contenu des variables internes de fonctions "
 "pouvent être intéressantes."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr "<emphasis>0x4000</emphasis> : informations de traçage de bas niveau."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
+#, fuzzy
+#| msgid ""
+#| "To log required debug levels, simply add their numbers together as shown "
+#| "in following examples:"
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 "Pour activer les niveaux de débogage requis, il suffit de faire la somme  de "
 "l'ensemble des numéros tel qu'illustré dans les exemples suivants :"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
@@ -10774,7 +10878,7 @@ msgstr ""
 "graves et les données de fonction, utiliser 0x0270."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
@@ -10784,15 +10888,26 @@ msgstr ""
 "pour les fonctions de contrôle interne, utiliser 0x1310."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
+#, fuzzy
+#| msgid ""
+#| "<emphasis>Note</emphasis>: This is new format of debug levels introduced "
+#| "in 1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
 msgstr ""
 "<emphasis>Note</emphasis> : il s'agit d'un nouveau format des niveaux de "
 "débogage introduit dans la version 1.7.0.  L'ancien format (nombres de 0 à "
 "10) est compatible mais déconseillé et voué à disparaître."
 
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+#, fuzzy
+#| msgid "<emphasis>h</emphasis> for hours"
+msgid "<emphasis>Default</emphasis>: 0"
+msgstr "<emphasis>h</emphasis> pour heures"
+
 #. type: Content of: outside any tag (error?)
 #: include/experimental.xml:1
 msgid ""
@@ -11055,5 +11170,33 @@ msgstr ""
 msgid "Default: Not set (SSSD will use the value retrieved from LDAP)"
 msgstr "Par défaut : Indéfini (SSSD utilisera la valeur récupérée de LDAP)"
 
+#~ msgid ""
+#~ "Directory to store credential caches. All the substitution sequences of "
+#~ "krb5_ccname_template can be used here, too, except %d and %P. If the "
+#~ "directory does not exist, it will be created. If %u, %U, %p or %h are "
+#~ "used, a private directory belonging to the user is created. Otherwise, a "
+#~ "public directory with restricted deletion flag (aka sticky bit, as "
+#~ "described in <citerefentry> <refentrytitle>chmod</refentrytitle> "
+#~ "<manvolnum>1</manvolnum> </citerefentry> for details) is created."
+#~ msgstr ""
+#~ "Répertoire pour stocker les caches crédits. Toutes les séquences de "
+#~ "substitution de krb5_ccname_template peuvent être utilisée ici, hormis %d "
+#~ "et %P. Si le dossier n'existe pas, il sera créé. Si %u, %U, %p ou %h sont "
+#~ "utilisés, un répertoire privé appartenant à l'utilisateur est créé. Sinon "
+#~ "un répertoire public avec un drapeau de restriction à la suppression "
+#~ "(aussi appelé « sticky bit », cf. <citerefentry> <refentrytitle>chmod</"
+#~ "refentrytitle> <manvolnum>1</manvolnum> </citerefentry> pour plus de "
+#~ "détails) est créé."
+
 #~ msgid "Default: FILE:%d/krb5cc_%U_XXXXXX"
 #~ msgstr "Par défaut : FICHIER:%d/krb5cc_%U_XXXXXX"
+
+#~ msgid ""
+#~ "Bit mask that indicates which debug levels will be visible. 0x0010 is the "
+#~ "default value as well as the lowest allowed value, 0xFFF0 is the most "
+#~ "verbose mode. This setting overrides the settings from config file."
+#~ msgstr ""
+#~ "Un masque de bits qui indique quels niveaux de débogage seront visibles. "
+#~ "0 x 0010 est la valeur par défaut ainsi que la plus basse autorisée, "
+#~ "0xFFF0 est le mode le plus détaillé. Ce paramètre prend le pas sur les "
+#~ "paramètres du fichier de configuration."
diff --git a/src/man/po/ja.po b/src/man/po/ja.po
index 437206ad3..7715586a6 100644
--- a/src/man/po/ja.po
+++ b/src/man/po/ja.po
@@ -10,10 +10,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-09-10 08:30+0000\n"
 "Last-Translator: Tomoyuki KATO <tomo@dream.daynight.jp>\n"
-"Language-Team: Japanese <trans-ja@lists.fedoraproject.org>\n"
+"Language-Team: Japanese (http://www.transifex.com/projects/p/fedora/language/"
+"ja/)\n"
 "Language: ja\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -498,7 +499,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr "初期値: 設定されません"
@@ -565,8 +566,8 @@ msgstr "デバッグメッセージに日時を追加します"
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "初期値: true"
 
@@ -585,7 +586,7 @@ msgstr "デバッグメッセージの日時にマイクロ秒を追加します
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "初期値: false"
 
@@ -2270,7 +2271,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "初期値: 6"
 
@@ -2318,7 +2319,7 @@ msgstr ""
 "このオプションはローカルプロバイダーにおいてサポートされません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr "初期値: True"
 
@@ -2610,7 +2611,7 @@ msgstr "初期値: なし、コマンドを実行しません"
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "例"
 
@@ -2832,7 +2833,7 @@ msgstr ""
 "な LDAP 検索フィルターである必要があります。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr "例:"
 
@@ -4470,7 +4471,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr "GSSAPI が使用されている場合、TGT の有効期間を秒単位で指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "初期値: 86400 (24 時間)"
 
@@ -4529,7 +4530,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr "初期値: システムの初期値、<filename>/etc/krb5.conf</filename> 参照。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (論理値)"
 
@@ -4543,12 +4544,12 @@ msgstr ""
 "します。この機能は MIT Kerberos >= 1.7 で利用可能です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4558,7 +4559,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -5548,13 +5549,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "注記"
@@ -6097,7 +6098,7 @@ msgstr ""
 "使用される完全修飾名を反映しないマシンにおいて設定されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (論理値)"
 
@@ -6112,7 +6113,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -6130,12 +6131,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -6156,12 +6157,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "初期値: 1200 (秒)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -6203,12 +6204,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -6216,12 +6217,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -6240,12 +6241,12 @@ msgid "Default: False (disabled)"
 msgstr "初期値: False (無効)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -6254,7 +6255,7 @@ msgstr ""
 "どうか。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -6358,7 +6359,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr "初期値: <emphasis>cn=ad,cn=etc,%basedn</emphasis> の値"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr "krb5_validate (論理値)"
 
@@ -6371,7 +6372,7 @@ msgstr ""
 "取得された TGT が改ざんされていないかを krb5_keytab の支援で確認します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -7038,9 +7039,81 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+#, fuzzy
+#| msgid "ad_enable_dns_sites (boolean)"
+msgid "ad_access_filter (boolean)"
+msgstr "ad_enable_dns_sites (論理値)"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: not set"
+msgid "Default: Not set"
+msgstr "初期値: 設定されません"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -7050,22 +7123,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr "初期値: 3600 (秒)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr "初期値: AD の LDAP 接続の IP アドレスを使用します"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr "krb5_use_enterprise_principal (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
@@ -7075,7 +7148,7 @@ msgstr ""
 "してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -7086,7 +7159,7 @@ msgstr ""
 "AD プロバイダー固有のオプションのみ示してします。"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -7110,7 +7183,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7122,7 +7195,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -7130,7 +7203,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -8029,114 +8102,102 @@ msgstr "krb5_ccachedir (文字列)"
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
-msgstr ""
-"クレディンシャルキャッシュを保存するディレクトリーです。すべての "
-"krb5_ccname_template の置換シーケンスが、%d と %P を除き、ここで使用できま"
-"す。ディレクトリーが存在しなければ、作成されます。%u, %U, %p または %h が使用"
-"されていると、ユーザーが所属するプライベートディレクトリーが作成されます。そ"
-"うでなければ、削除制限フラグ（つまり、詳細が <citerefentry> "
-"<refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> </"
-"citerefentry> に記載されているとおり、スティッキービットです）を持つ公開ディ"
-"レクトリーが作成されます。"
-
-#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr "初期値: /tmp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr "krb5_ccname_template (文字列)"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr "%u"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr "ログイン名"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr "%U"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr "ログイン UID"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr "%p"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr "プリンシパル名"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr "%r"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr "レルム名"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr "%h"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr "ホームディレクトリー"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr "%d"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr "krb5ccache_dir の値"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr "%P"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr "SSSD クライアントのプロセス ID"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr "%%"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr "文字 '%'"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 #, fuzzy
 #| msgid ""
 #| "Location of the user's credential cache. Two credential cache types are "
@@ -8165,7 +8226,7 @@ msgstr ""
 "なファイル名を作成するために使用されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -8174,7 +8235,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -8184,19 +8245,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "初期値: 0 (無制限)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr "krb5_auth_timeout (整数)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -8206,7 +8267,7 @@ msgstr ""
 "す。可能ならば、認証要求がオフラインで継続されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -8217,12 +8278,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr "krb5_keytab (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
@@ -8231,24 +8292,24 @@ msgstr ""
 "です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr "初期値: /etc/krb5.keytab"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr "krb5_store_password_if_offline (論理値)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -8256,44 +8317,44 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr "krb5_renewable_lifetime (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr "秒は <emphasis>s</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr "分は <emphasis>m</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr "時間は <emphasis>h</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr "日は <emphasis>d</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr "単位が指定されていないと、<emphasis>s</emphasis> と仮定されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
@@ -8302,29 +8363,29 @@ msgstr ""
 "指定したい場合、'1h30m' の代わりに '90m' を使用します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr "初期値: 設定されません、つまり TGT は更新可能ではありません"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr "krb5_lifetime (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr "単位が指定されていないと、<emphasis>s</emphasis> と仮定されます。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
@@ -8333,7 +8394,7 @@ msgstr ""
 "指定したい場合、'1h30m' の代わりに '90m' を使用してください。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
@@ -8341,12 +8402,12 @@ msgstr ""
 "期値です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr "krb5_renew_interval (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -8354,19 +8415,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 "このオプションが設定されていない場合、または 0 に設定されている場合、自動更新"
 "は無効になります。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr "krb5_use_fast (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
@@ -8375,7 +8436,7 @@ msgstr ""
 "を有効化します。以下のオプションがサポートされます:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
@@ -8384,7 +8445,7 @@ msgstr ""
 "いことと同等です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
@@ -8393,7 +8454,7 @@ msgstr ""
 "いなければ、FAST を使用せずに認証を続行します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
@@ -8402,17 +8463,17 @@ msgstr ""
 "ければ、認証が失敗します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr "初期値: 設定されません、つまり FAST が使用されません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr "注: キーテーブルは FAST を使用する必要があります。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -8423,17 +8484,17 @@ msgstr ""
 "ンを使用すると設定エラーになります。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr "krb5_fast_principal (文字列)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr "FAST に対して使用するサーバープリンシパルを指定します。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
@@ -8442,7 +8503,7 @@ msgstr ""
 "MIT Kerberos 1.7 およびそれ以降で利用可能です。"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -8462,7 +8523,7 @@ msgstr ""
 "quote> を参照してください。  <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -8474,7 +8535,7 @@ msgstr ""
 "の設定のみを示し、識別プロバイダーを何も含みません。"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -9761,101 +9822,145 @@ msgstr "<option>-h</option>,<option>--help</option>"
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
-"デバッグレベルを指示するビットマスクは見ることができます。 0x0010 は初期値で"
-"あり、利用できる最小値です。 0xFFF0 は最も冗長なモードです。この設定は設定"
-"ファイルの設定により上書きされます。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr "現在サポートされるデバッグレベル:"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
+#| "SSSD from starting up or causes it to cease running."
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 "<emphasis>0x0010</emphasis>: 致命的なエラー。 SSSD が開始するのを妨げる、また"
 "は実行を中断させることすべてです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't "
+#| "kill the SSSD, but one that indicates that at least one major feature is "
+#| "not going to work properly."
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 "<emphasis>0x0020</emphasis>: 重大なエラー。 SSSD が強制停止しないが、複数の機"
 "能が正しく動作しないエラーです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
+#| "particular request or operation has failed."
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 "<emphasis>0x0040</emphasis>: 深刻なエラー。特定の要求や操作が失敗したことを通"
 "知するエラーです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0080</emphasis>: Minor failures. These are the errors that "
+#| "would percolate down to cause the operation failure of 2."
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 "<emphasis>0x0080</emphasis>: 軽微なエラー。これらは 2 の操作失敗を引き起こす"
 "よう下にしみだすエラーです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+#, fuzzy
+#| msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr "<emphasis>0x0100</emphasis>: 設定値の設定です。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+#, fuzzy
+#| msgid "<emphasis>0x0200</emphasis>: Function data."
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr "<emphasis>0x0200</emphasis>: 関数のデータです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+#, fuzzy
+#| msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr "<emphasis>0x0400</emphasis>: 操作関数のトレースメッセージです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x1000</emphasis>: Trace messages for internal control "
+#| "functions."
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr "<emphasis>0x1000</emphasis>: 内部制御関数のトレースメッセージです。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
+#| "may be interesting."
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 "<emphasis>0x2000</emphasis>: 興味があるかもしれない関数の内部変数の内容です。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr "<emphasis>0x4000</emphasis>: 極めて低レベルのトレース情報です。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
+#, fuzzy
+#| msgid ""
+#| "To log required debug levels, simply add their numbers together as shown "
+#| "in following examples:"
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 "必要となるデバッグレベルをログに取得するには、以下の例に示されるようにこれら"
 "の数字を単に追加します:"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
@@ -9864,7 +9969,7 @@ msgstr ""
 "データをログに取得するには 0x0270 を使用します。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
@@ -9873,14 +9978,25 @@ msgstr ""
 "数のトレースメッセージをログに取得するには 0x1310 を使用します。"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
+#, fuzzy
+#| msgid ""
+#| "<emphasis>Note</emphasis>: This is new format of debug levels introduced "
+#| "in 1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
 msgstr ""
 "<emphasis>注</emphasis>: これは 1.7.0 において導入されたデバッグレベルの新し"
 "い形式です。古い形式（0-10 の数字）は互換性がありますが、推奨されません。"
 
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+#, fuzzy
+#| msgid "<emphasis>h</emphasis> for hours"
+msgid "<emphasis>Default</emphasis>: 0"
+msgstr "時間は <emphasis>h</emphasis>"
+
 #. type: Content of: outside any tag (error?)
 #: include/experimental.xml:1
 msgid ""
@@ -10119,5 +10235,32 @@ msgstr ""
 msgid "Default: Not set (SSSD will use the value retrieved from LDAP)"
 msgstr "初期値: 設定なし (SSSD は LDAP から取得された値を使用します)"
 
+#~ msgid ""
+#~ "Directory to store credential caches. All the substitution sequences of "
+#~ "krb5_ccname_template can be used here, too, except %d and %P. If the "
+#~ "directory does not exist, it will be created. If %u, %U, %p or %h are "
+#~ "used, a private directory belonging to the user is created. Otherwise, a "
+#~ "public directory with restricted deletion flag (aka sticky bit, as "
+#~ "described in <citerefentry> <refentrytitle>chmod</refentrytitle> "
+#~ "<manvolnum>1</manvolnum> </citerefentry> for details) is created."
+#~ msgstr ""
+#~ "クレディンシャルキャッシュを保存するディレクトリーです。すべての "
+#~ "krb5_ccname_template の置換シーケンスが、%d と %P を除き、ここで使用できま"
+#~ "す。ディレクトリーが存在しなければ、作成されます。%u, %U, %p または %h が"
+#~ "使用されていると、ユーザーが所属するプライベートディレクトリーが作成されま"
+#~ "す。そうでなければ、削除制限フラグ（つまり、詳細が <citerefentry> "
+#~ "<refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> </"
+#~ "citerefentry> に記載されているとおり、スティッキービットです）を持つ公開"
+#~ "ディレクトリーが作成されます。"
+
 #~ msgid "Default: FILE:%d/krb5cc_%U_XXXXXX"
 #~ msgstr "初期値: FILE:%d/krb5cc_%U_XXXXXX"
+
+#~ msgid ""
+#~ "Bit mask that indicates which debug levels will be visible. 0x0010 is the "
+#~ "default value as well as the lowest allowed value, 0xFFF0 is the most "
+#~ "verbose mode. This setting overrides the settings from config file."
+#~ msgstr ""
+#~ "デバッグレベルを指示するビットマスクは見ることができます。 0x0010 は初期値"
+#~ "であり、利用できる最小値です。 0xFFF0 は最も冗長なモードです。この設定は設"
+#~ "定ファイルの設定により上書きされます。"
diff --git a/src/man/po/lv.po b/src/man/po/lv.po
index 6dfdfbcc7..bfc3b2590 100644
--- a/src/man/po/lv.po
+++ b/src/man/po/lv.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
 "Language-Team: Latvian (http://www.transifex.com/projects/p/fedora/language/"
@@ -436,7 +436,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -495,8 +495,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -515,7 +515,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -2013,7 +2013,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Noklusējuma: 6"
 
@@ -2057,7 +2057,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2316,7 +2316,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "PIEMĒRS"
 
@@ -2492,7 +2492,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -3997,7 +3997,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "Noklusējuma: 86400 (24 stundas)"
 
@@ -4050,7 +4050,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4062,12 +4062,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4077,7 +4077,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4957,13 +4957,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "PIEZĪMES"
@@ -5404,7 +5404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5419,7 +5419,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5434,12 +5434,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5460,12 +5460,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5507,12 +5507,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5520,12 +5520,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5544,19 +5544,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5647,7 +5647,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5659,7 +5659,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6267,9 +6267,79 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: filter"
+msgid "Default: Not set"
+msgstr "Noklusējuma: filtrēt"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6279,29 +6349,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6309,7 +6379,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6324,7 +6394,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6333,7 +6403,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6341,7 +6411,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7098,106 +7168,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr "Noklusējuma: / tmp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr "%u"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr "%U"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7210,7 +7276,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7219,7 +7285,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7229,19 +7295,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "Noklusējuma: 0 (bez ierobežojuma)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7249,7 +7315,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7260,36 +7326,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr "Noklusējuma: /etc/krb5.keytab"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7297,91 +7363,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7389,55 +7455,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7445,24 +7511,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7477,7 +7543,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7486,7 +7552,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8597,104 +8663,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/nl.po b/src/man/po/nl.po
index 7c4b73df1..e2d266ebc 100644
--- a/src/man/po/nl.po
+++ b/src/man/po/nl.po
@@ -8,7 +8,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
 "Language-Team: Dutch (http://www.transifex.com/projects/p/fedora/language/"
@@ -483,7 +483,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -542,8 +542,8 @@ msgstr "Voeg een tijdstempel toe aan de debugberichten"
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Standaard: true"
 
@@ -562,7 +562,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -2071,7 +2071,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2115,7 +2115,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2374,7 +2374,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr ""
 
@@ -2550,7 +2550,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -4055,7 +4055,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4108,7 +4108,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4120,12 +4120,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4135,7 +4135,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -5015,13 +5015,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
@@ -5462,7 +5462,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5477,7 +5477,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5492,12 +5492,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5518,12 +5518,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5565,12 +5565,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5578,12 +5578,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5602,19 +5602,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5705,7 +5705,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5717,7 +5717,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6325,9 +6325,79 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: true"
+msgid "Default: Not set"
+msgstr "Standaard: true"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6337,29 +6407,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6367,7 +6437,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6382,7 +6452,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6391,7 +6461,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6399,7 +6469,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7156,106 +7226,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7268,7 +7334,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7277,7 +7343,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7287,17 +7353,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 msgid "Default: (from libkrb5)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7305,7 +7371,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7316,36 +7382,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7353,91 +7419,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7445,55 +7511,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7501,24 +7567,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7533,7 +7599,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7542,7 +7608,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8653,104 +8719,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/pt.po b/src/man/po/pt.po
index 2e83dc96f..cb1e36502 100644
--- a/src/man/po/pt.po
+++ b/src/man/po/pt.po
@@ -8,10 +8,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
-"Language-Team: Portuguese <trans-pt@lists.fedoraproject.org>\n"
+"Language-Team: Portuguese (http://www.transifex.com/projects/p/fedora/"
+"language/pt/)\n"
 "Language: pt\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -464,7 +465,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -523,8 +524,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -543,7 +544,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "Padrão: false"
 
@@ -2043,7 +2044,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Padrão: 6"
 
@@ -2087,7 +2088,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr "Padrão: TRUE"
 
@@ -2346,7 +2347,7 @@ msgstr "Padrão: None, nenhum comando é executado"
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "EXEMPLO"
 
@@ -2546,7 +2547,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr "Exemplos:"
 
@@ -4058,7 +4059,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "Padrão: 86400 (24 horas)"
 
@@ -4111,7 +4112,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (boolean)"
 
@@ -4123,12 +4124,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4138,7 +4139,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -5018,13 +5019,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "NOTAS"
@@ -5471,7 +5472,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5486,7 +5487,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5501,12 +5502,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5527,12 +5528,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5574,12 +5575,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5587,12 +5588,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5611,19 +5612,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5714,7 +5715,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr "krb5_validate (boolean)"
 
@@ -5726,7 +5727,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6338,9 +6339,81 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+#, fuzzy
+#| msgid "case_sensitive (boolean)"
+msgid "ad_access_filter (boolean)"
+msgstr "case_sensitive (boolean)"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: host"
+msgid "Default: Not set"
+msgstr "Padrão: host"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6350,29 +6423,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6380,7 +6453,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6395,7 +6468,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6404,7 +6477,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6412,7 +6485,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7179,106 +7252,102 @@ msgstr "krb5_ccachedir (string)"
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr "Padrão: /tmp."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr "krb5_ccname_template (string)"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr "%u"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr "nome de login"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr "%U"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr "%p"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr "nome principal"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr "%r"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr "nome de território"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr "%h"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr "%d"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr "valor de krb5ccache_dir"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr "%P"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr "%%"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr "um literal '%'"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7291,7 +7360,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7300,7 +7369,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7310,19 +7379,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: filter"
 msgid "Default: (from libkrb5)"
 msgstr "Padrão: filter"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr "krb5_auth_timeout (integer)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7330,7 +7399,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7341,36 +7410,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr "krb5_keytab (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr "Padrão: /etc/krb5.keytab"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr "krb5_store_password_if_offline (boolean)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7378,91 +7447,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr "krb5_renewable_lifetime (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr "Padrão: não definido, ou seja, o TGT não é renovável"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr "krb5_lifetime (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7470,55 +7539,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7526,24 +7595,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr "krb5_fast_principal (string)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7558,7 +7627,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7567,7 +7636,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8688,104 +8757,118 @@ msgstr "<option>-h</option>,<option>--help</option>"
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/ru.po b/src/man/po/ru.po
index 6a369f536..e39f34dea 100644
--- a/src/man/po/ru.po
+++ b/src/man/po/ru.po
@@ -8,10 +8,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
-"Language-Team: Russian <trans-ru@lists.fedoraproject.org>\n"
+"Language-Team: Russian (http://www.transifex.com/projects/p/fedora/language/"
+"ru/)\n"
 "Language: ru\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -435,7 +436,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -494,8 +495,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -514,7 +515,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "По умолчанию: false"
 
@@ -2012,7 +2013,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2056,7 +2057,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2315,7 +2316,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "ПРИМЕР"
 
@@ -2491,7 +2492,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -3996,7 +3997,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4049,7 +4050,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4061,12 +4062,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4076,7 +4077,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4956,13 +4957,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
@@ -5403,7 +5404,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5418,7 +5419,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5433,12 +5434,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5459,12 +5460,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5506,12 +5507,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5519,12 +5520,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5543,19 +5544,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5646,7 +5647,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5658,7 +5659,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6266,9 +6267,79 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: root"
+msgid "Default: Not set"
+msgstr "По умолчанию: root"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6278,29 +6349,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6308,7 +6379,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6323,7 +6394,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6332,7 +6403,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6340,7 +6411,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7097,106 +7168,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7209,7 +7276,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7218,7 +7285,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7228,19 +7295,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "По умолчанию: 0 (неограничено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7248,7 +7315,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7259,36 +7326,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7296,91 +7363,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7388,55 +7455,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7444,24 +7511,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7476,7 +7543,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7485,7 +7552,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8596,104 +8663,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/sssd-docs.pot b/src/man/po/sssd-docs.pot
index 7903e9698..8fa1f2f1b 100644
--- a/src/man/po/sssd-docs.pot
+++ b/src/man/po/sssd-docs.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: sssd-docs 1.11.1\n"
+"Project-Id-Version: sssd-docs 1.11.2\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -409,7 +409,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383 sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378 sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145 include/ldap_id_mapping.xml:156
+#: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383 sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378 sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145 include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
 
@@ -464,7 +464,7 @@ msgid "Add a timestamp to the debug messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819 sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697 sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222 sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191 sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819 sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697 sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222 sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250 sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -479,7 +479,7 @@ msgid "Add microseconds to the timestamp in debug messages"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:303 sssd.conf.5.xml:773 sssd.conf.5.xml:1763 sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431 sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139 sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492 sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd.conf.5.xml:303 sssd.conf.5.xml:773 sssd.conf.5.xml:1763 sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431 sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139 sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492 sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -1972,7 +1972,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139 sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139 sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2016,7 +2016,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2273,7 +2273,7 @@ msgid "Default: None, no command is run"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131 sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131 sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr ""
 
@@ -2449,7 +2449,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -3950,7 +3950,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4004,7 +4004,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4016,12 +4016,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4031,7 +4031,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> "
 "<refentrytitle>sssd_krb5_locator_plugin</refentrytitle> "
@@ -4912,12 +4912,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
-#: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767 sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535 include/ldap_id_mapping.xml:63
+#: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767 sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528 include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321 sssd.8.xml:191 sss_seed.8.xml:163
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380 sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
 
@@ -5363,7 +5363,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5378,7 +5378,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5393,12 +5393,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5419,12 +5419,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5467,12 +5467,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5480,12 +5480,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5504,19 +5504,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5606,7 +5606,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5618,7 +5618,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6227,9 +6227,77 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the "
+"<quote>access_filter</quote> option must be explicitly set to "
+"<quote>ad</quote> in order for this option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or "
+"forest. This extended filter would consist of: "
+"<quote>KEYWORD:NAME:FILTER</quote>.  The keyword can be either "
+"<quote>DOM</quote>, <quote>FOREST</quote> or missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then "
+"<quote>NAME</quote> specifies the domain or subdomain the filter applies "
+"to.  If the keyword equals to <quote>FOREST</quote>, then the filter equals "
+"to all domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the "
+"per-domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+msgid "Default: Not set"
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6239,22 +6307,22 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise "
 "principal. See section 5 of RFC 6806 for more details about enterprise "
@@ -6262,7 +6330,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and "
 "example.com is one of the domains in the <replaceable>[sssd]</replaceable> "
@@ -6270,7 +6338,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6285,7 +6353,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6294,7 +6362,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6302,7 +6370,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7059,106 +7127,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7171,7 +7235,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is "
 "<quote>KEYRING:persistent:%U</quote>, which uses the Linux kernel keyring to "
@@ -7180,7 +7244,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7190,17 +7254,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 msgid "Default: (from libkrb5)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7208,7 +7272,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7219,36 +7283,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7256,90 +7320,90 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7347,55 +7411,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos "
 "pre-authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7403,24 +7467,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7436,7 +7500,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7445,7 +7509,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8563,103 +8627,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal "
+"failures. Anything that would prevent SSSD from starting up or causes it to "
+"cease running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of "
+"2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid "<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
-msgid "<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+#: include/debug_levels.xml:48
+msgid ""
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of "
+"function-internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/tg.po b/src/man/po/tg.po
index 238c0f71f..3695ce610 100644
--- a/src/man/po/tg.po
+++ b/src/man/po/tg.po
@@ -7,7 +7,7 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
 "Language-Team: Tajik (http://www.transifex.com/projects/p/fedora/language/"
@@ -434,7 +434,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -493,8 +493,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Пешфарз: true"
 
@@ -513,7 +513,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "Пешфарз: false"
 
@@ -2011,7 +2011,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Пешфарз: 6"
 
@@ -2055,7 +2055,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2314,7 +2314,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "НАМУНА"
 
@@ -2490,7 +2490,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr "Намунаҳо:"
 
@@ -3995,7 +3995,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4048,7 +4048,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4060,12 +4060,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4075,7 +4075,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4955,13 +4955,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "ЭЗОҲҲО"
@@ -5402,7 +5402,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5417,7 +5417,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5432,12 +5432,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5458,12 +5458,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5505,12 +5505,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5518,12 +5518,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5542,19 +5542,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5645,7 +5645,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5657,7 +5657,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6265,9 +6265,79 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: true"
+msgid "Default: Not set"
+msgstr "Пешфарз: true"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6277,29 +6347,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6307,7 +6377,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6322,7 +6392,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6331,7 +6401,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6339,7 +6409,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7096,106 +7166,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr "Номи логин"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7208,7 +7274,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7217,7 +7283,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7227,19 +7293,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "Пешфарз: 0 (Номаҳдуд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7247,7 +7313,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7258,36 +7324,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7295,91 +7361,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7387,55 +7453,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7443,24 +7509,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7475,7 +7541,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7484,7 +7550,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8595,104 +8661,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)
diff --git a/src/man/po/uk.po b/src/man/po/uk.po
index 777d09c23..de16eca0a 100644
--- a/src/man/po/uk.po
+++ b/src/man/po/uk.po
@@ -10,10 +10,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 13:30+0000\n"
 "Last-Translator: Yuri Chornoivan <yurchor@ukr.net>\n"
-"Language-Team: Ukrainian <trans-uk@lists.fedoraproject.org>\n"
+"Language-Team: Ukrainian (http://www.transifex.com/projects/p/fedora/"
+"language/uk/)\n"
 "Language: uk\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -529,7 +530,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr "Типове значення: not set"
@@ -597,8 +598,8 @@ msgstr "Додати часову позначку до діагностични
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr "Типове значення: true"
 
@@ -618,7 +619,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr "Типове значення: false"
 
@@ -2456,7 +2457,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr "Типове значення: 6"
 
@@ -2505,7 +2506,7 @@ msgstr ""
 "версії підтримку передбачено лише для локальних надавачів даних."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr "Типове значення: True"
 
@@ -2813,7 +2814,7 @@ msgstr "Типове значення: None, не виконувати жодн�
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr "ПРИКЛАД"
 
@@ -3051,7 +3052,7 @@ msgstr ""
 "специфікації http://www.ietf.org/rfc/rfc2254.txt"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr "Приклади:"
 
@@ -4816,7 +4817,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr "Визначає строк дії (у секундах) TGT, якщо використовується GSSAPI."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr "Типове значення: 86400 (24 години)"
 
@@ -4885,7 +4886,7 @@ msgstr ""
 "filename>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr "krb5_canonicalize (булеве значення)"
 
@@ -4900,12 +4901,12 @@ msgstr ""
 "версії MIT Kerberos >= 1.7"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr "krb5_use_kdcinfo (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4920,7 +4921,7 @@ msgstr ""
 "<manvolnum>5</manvolnum> </citerefentry>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -5975,13 +5976,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr "<placeholder type=\"programlisting\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr "ЗАУВАЖЕННЯ"
@@ -6585,7 +6586,7 @@ msgstr ""
 "цього вузла."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr "dyndns_update (булеве значення)"
 
@@ -6605,7 +6606,7 @@ msgstr ""
 "допомогою параметра «dyndns_iface»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -6626,12 +6627,12 @@ msgstr ""
 "назву, <emphasis>dyndns_update</emphasis>, у файлі налаштувань."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr "dyndns_ttl (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -6658,12 +6659,12 @@ msgid "Default: 1200 (seconds)"
 msgstr "Типове значення: 1200 (секунд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr "dyndns_iface (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -6719,12 +6720,12 @@ msgstr ""
 "вважатимуться резервними серверами."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr "dyndns_refresh_interval (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -6736,12 +6737,12 @@ msgstr ""
 "є обов’язкоми, його застосовують, лише якщо dyndns_update має значення true."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr "dyndns_update_ptr (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -6765,12 +6766,12 @@ msgid "Default: False (disabled)"
 msgstr "Типове значення: False (вимкнено)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr "dyndns_force_tcp (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
@@ -6779,7 +6780,7 @@ msgstr ""
 "даними з сервером DNS."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr "Типове значення: False (надати змогу nsupdate вибирати протокол)"
 
@@ -6884,7 +6885,7 @@ msgstr ""
 "Типове значення: значення виразу <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr "krb5_validate (булеве значення)"
 
@@ -6897,7 +6898,7 @@ msgstr ""
 "Перевірити за допомогою krb5_keytab, чи не було підмінено отриманий TGT."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -7646,9 +7647,81 @@ msgstr ""
 "SRV DNS, зокрема домен пошуку, використовуються також під час визначення "
 "сайтів."
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+#, fuzzy
+#| msgid "ad_enable_dns_sites (boolean)"
+msgid "ad_access_filter (boolean)"
+msgstr "ad_enable_dns_sites (булеве значення)"
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: not set"
+msgid "Default: Not set"
+msgstr "Типове значення: not set"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -7664,22 +7737,22 @@ msgstr ""
 "якщо цю адресу не було змінено за допомогою параметра «dyndns_iface»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr "Типове значення: 3600 (секунд)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr "Типове значення: використовувати IP-адресу з’єднання LDAP AD"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr "krb5_use_enterprise_principal (булеве значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
@@ -7689,7 +7762,7 @@ msgstr ""
 "реєстраційні дані."
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -7700,7 +7773,7 @@ msgstr ""
 "У прикладі продемонстровано лише параметри доступу, специфічні для засобу AD."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -7724,7 +7797,7 @@ msgstr ""
 "ad_domain = example.com\n"
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -7736,7 +7809,7 @@ msgstr ""
 "ldap_account_expire_policy = ad\n"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -7748,7 +7821,7 @@ msgstr ""
 "\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -8740,114 +8813,102 @@ msgstr "krb5_ccachedir (рядок)"
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
-msgstr ""
-"Каталог для зберігання кешу реєстраційних даних. Тут можна використовувати "
-"всі послідовності-замінники krb5_ccname_template, окрім %d і %P. Якщо "
-"каталогу не існує, його буде створено. Якщо використано %u, %U, %p або %h, "
-"буде створено особистий каталог, власником якого буде користувач. Якщо цих "
-"замінників не буде використано, буде створено відкритий каталог з обмеженням "
-"на вилучення (або липким бітом, докладніші відомості викладено у довіднику "
-"(man) з <citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</"
-"manvolnum> </citerefentry>)."
-
-#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr "Типове значення: /tmp"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr "krb5_ccname_template (рядок)"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr "%u"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr "ім'я користувача"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr "%U"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr "ідентифікатор користувача"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr "%p"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr "назва реєстраційного запису"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr "%r"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr "назва області"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr "%h"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr "домашній каталог"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr "%d"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr "значення krb5ccache_dir"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr "%P"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr "ідентифікатор процесу клієнтської частини SSSD"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr "%%"
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr "символ відсотків («%»)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 #, fuzzy
 #| msgid ""
 #| "Location of the user's credential cache. Two credential cache types are "
@@ -8877,7 +8938,7 @@ msgstr ""
 "для безпечного створення назви файла використовується mkstemp(3)."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -8886,7 +8947,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -8896,19 +8957,19 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 #, fuzzy
 #| msgid "Default: 0 (No limit)"
 msgid "Default: (from libkrb5)"
 msgstr "Типове значення: 0 (без обмежень)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr "krb5_auth_timeout (ціле число)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -8919,7 +8980,7 @@ msgstr ""
 "розпізнавання буде продовжено у автономному режимі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -8938,12 +8999,12 @@ msgstr ""
 "його єдиним записом у файлі таблиці ключів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr "krb5_keytab (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
@@ -8952,17 +9013,17 @@ msgstr ""
 "реєстраційних даних, отриманих від KDC."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr "Типове значення: /etc/krb5.keytab"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr "krb5_store_password_if_offline (булівське значення)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
@@ -8972,7 +9033,7 @@ msgstr ""
 "перевірки."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -8984,12 +9045,12 @@ msgstr ""
 "користувач (root), але йому для цього слід буде подолати деякі перешкоди."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr "krb5_renewable_lifetime (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
@@ -8998,34 +9059,34 @@ msgstr ""
 "за допомогою цілого числа, за яким одразу вказано одиницю часу:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr "<emphasis>s</emphasis> — секунди"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr "<emphasis>m</emphasis> — хвилини"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr "<emphasis>h</emphasis> — години"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr "<emphasis>d</emphasis> — дні."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 "Якщо одиниці часу не буде вказано, вважатиметься, що використано одиницю "
 "<emphasis>s</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
@@ -9035,17 +9096,17 @@ msgstr ""
 "«1h30m»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr "Типове значення: не встановлено, тобто TGT не є оновлюваним"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr "krb5_lifetime (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
@@ -9054,14 +9115,14 @@ msgstr ""
 "цілого числа, за яким одразу вказано одиницю часу:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 "Якщо одиниці часу не буде вказано, вважатиметься, що використано одиницю "
 "<emphasis>s</emphasis>."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
@@ -9071,7 +9132,7 @@ msgstr ""
 "«1h30m»."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
@@ -9079,12 +9140,12 @@ msgstr ""
 "визначатиметься у налаштуваннях KDC."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr "krb5_renew_interval (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -9096,19 +9157,19 @@ msgstr ""
 "одиниці часу:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 "Якщо значення для цього параметра встановлено не буде або буде встановлено "
 "значення 0, автоматичного оновлення не відбуватиметься."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr "krb5_use_fast (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
@@ -9118,7 +9179,7 @@ msgstr ""
 "Kerberos. Передбачено такі варіанти:"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
@@ -9127,7 +9188,7 @@ msgstr ""
 "якого значення цього параметра взагалі не задається."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
@@ -9136,7 +9197,7 @@ msgstr ""
 "передбачено підтримки FAST, продовжити розпізнавання без FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
@@ -9145,19 +9206,19 @@ msgstr ""
 "передбачено підтримки FAST, спроба розпізнавання зазнає невдачі."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr "Типове значення: не встановлено, тобто FAST не використовується."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 "Зауваження: будь ласка, зауважте, що для використання FAST потрібна таблиця "
 "ключів."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -9169,18 +9230,18 @@ msgstr ""
 "налаштуваннях."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr "krb5_fast_principal (рядок)"
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 "Визначає реєстраційний запис сервера, який слід використовувати для FAST."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
@@ -9189,7 +9250,7 @@ msgstr ""
 "канонічну форму. Цю можливість передбачено з версії MIT Kerberos 1.7."
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr "Типове значення: false (надається AD: true)"
 
@@ -9209,7 +9270,7 @@ msgstr ""
 "про налаштування домену SSSD. <placeholder type=\"variablelist\" id=\"0\"/>"
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -9222,7 +9283,7 @@ msgstr ""
 "Kerberos, там не вказано інструменту обробки профілів."
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -10638,106 +10699,150 @@ msgstr "<option>-h</option>,<option>--help</option>"
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
-"Бітова маска, яка визначає рівні діагностики, дані яких буде показано. "
-"0x0010 — типове і найменше можливе значення. 0xFFF0 — найдокладніший режим. "
-"Визначення цього параметра має пріоритет над визначенням у файлі налаштувань."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr "Рівні діагностики, передбачені у поточній версії:"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
+#| "SSSD from starting up or causes it to cease running."
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 "<emphasis>0x0010</emphasis>: критичні помилки з аварійним завершенням "
 "роботи. Всі помилки, які не дають SSSD змоги розпочати або продовжувати "
 "роботу."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't "
+#| "kill the SSSD, but one that indicates that at least one major feature is "
+#| "not going to work properly."
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 "<emphasis>0x0020</emphasis>: критичні помилки. Помилки, які не призводять до "
 "аварійного завершення роботи SSSD, але означають, що одна з основних "
 "можливостей не працює належним чином."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
+#| "particular request or operation has failed."
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 "<emphasis>0x0040</emphasis>: серйозні помилки. Повідомлення про такі помилки "
 "означають, що не вдалося виконати певний запит або дію."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x0080</emphasis>: Minor failures. These are the errors that "
+#| "would percolate down to cause the operation failure of 2."
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 "<emphasis>0x0080</emphasis>: незначні помилки. Це помилки які можуть "
 "призвести до помилок під час виконання дій."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+#, fuzzy
+#| msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr "<emphasis>0x0100</emphasis>: параметри налаштування."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+#, fuzzy
+#| msgid "<emphasis>0x0200</emphasis>: Function data."
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr "<emphasis>0x0200</emphasis>: дані функцій."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+#, fuzzy
+#| msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr "<emphasis>0x0400</emphasis>: повідомлення трасування для функцій дій."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x1000</emphasis>: Trace messages for internal control "
+#| "functions."
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 "<emphasis>0x1000</emphasis>: повідомлення трасування для функцій "
 "внутрішнього трасування."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
+#| "may be interesting."
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 "<emphasis>0x2000</emphasis>: вміст внутрішніх змінних функцій, який може "
 "бути цікавим."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+#, fuzzy
+#| msgid ""
+#| "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr "<emphasis>0x4000</emphasis>: дані трасування найнижчого рівня."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
+#, fuzzy
+#| msgid ""
+#| "To log required debug levels, simply add their numbers together as shown "
+#| "in following examples:"
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 "Щоб до журналу було записано дані потрібних рівнів діагностики, просто "
 "додайте відповідні числа, як це показано у наведених нижче прикладах:"
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
@@ -10747,7 +10852,7 @@ msgstr ""
 "серйозних помилок та дані функцій, скористайтеся рівнем діагностики 0x0270."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
@@ -10758,16 +10863,27 @@ msgstr ""
 "рівнем 0x1310."
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
+#, fuzzy
+#| msgid ""
+#| "<emphasis>Note</emphasis>: This is new format of debug levels introduced "
+#| "in 1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
 msgstr ""
 "<emphasis>Зауваження</emphasis>: цей новий формат визначення рівнів "
 "діагностики впроваджено у версії 1.7.0.  Визначення у форматах попередніх "
 "версій (числа від 0 до 10) сумісні сз поточною версією, але вважаються "
 "застарілими."
 
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+#, fuzzy
+#| msgid "<emphasis>h</emphasis> for hours"
+msgid "<emphasis>Default</emphasis>: 0"
+msgstr "<emphasis>h</emphasis> — години"
+
 #. type: Content of: outside any tag (error?)
 #: include/experimental.xml:1
 msgid ""
@@ -11034,5 +11150,34 @@ msgstr ""
 "Типове значення: не встановлено (SSSD використовуватиме значення, отримане "
 "від LDAP)"
 
+#~ msgid ""
+#~ "Directory to store credential caches. All the substitution sequences of "
+#~ "krb5_ccname_template can be used here, too, except %d and %P. If the "
+#~ "directory does not exist, it will be created. If %u, %U, %p or %h are "
+#~ "used, a private directory belonging to the user is created. Otherwise, a "
+#~ "public directory with restricted deletion flag (aka sticky bit, as "
+#~ "described in <citerefentry> <refentrytitle>chmod</refentrytitle> "
+#~ "<manvolnum>1</manvolnum> </citerefentry> for details) is created."
+#~ msgstr ""
+#~ "Каталог для зберігання кешу реєстраційних даних. Тут можна "
+#~ "використовувати всі послідовності-замінники krb5_ccname_template, окрім "
+#~ "%d і %P. Якщо каталогу не існує, його буде створено. Якщо використано %u, "
+#~ "%U, %p або %h, буде створено особистий каталог, власником якого буде "
+#~ "користувач. Якщо цих замінників не буде використано, буде створено "
+#~ "відкритий каталог з обмеженням на вилучення (або липким бітом, докладніші "
+#~ "відомості викладено у довіднику (man) з <citerefentry> "
+#~ "<refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> </"
+#~ "citerefentry>)."
+
 #~ msgid "Default: FILE:%d/krb5cc_%U_XXXXXX"
 #~ msgstr "Типове значення: FILE:%d/krb5cc_%U_XXXXXX"
+
+#~ msgid ""
+#~ "Bit mask that indicates which debug levels will be visible. 0x0010 is the "
+#~ "default value as well as the lowest allowed value, 0xFFF0 is the most "
+#~ "verbose mode. This setting overrides the settings from config file."
+#~ msgstr ""
+#~ "Бітова маска, яка визначає рівні діагностики, дані яких буде показано. "
+#~ "0x0010 — типове і найменше можливе значення. 0xFFF0 — найдокладніший "
+#~ "режим. Визначення цього параметра має пріоритет над визначенням у файлі "
+#~ "налаштувань."
diff --git a/src/man/po/zh_CN.po b/src/man/po/zh_CN.po
index 67ae06f52..bfd233038 100644
--- a/src/man/po/zh_CN.po
+++ b/src/man/po/zh_CN.po
@@ -8,10 +8,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: SSSD\n"
 "Report-Msgid-Bugs-To: sssd-devel@redhat.com\n"
-"POT-Creation-Date: 2013-09-27 21:04+0300\n"
+"POT-Creation-Date: 2013-10-30 23:21+0100\n"
 "PO-Revision-Date: 2013-07-24 12:28+0000\n"
 "Last-Translator: jhrozek <jhrozek@redhat.com>\n"
-"Language-Team: Chinese (China) <trans-zh_cn@lists.fedoraproject.org>\n"
+"Language-Team: Chinese (China) (http://www.transifex.com/projects/p/fedora/"
+"language/zh_CN/)\n"
 "Language: zh_CN\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
@@ -440,7 +441,7 @@ msgstr ""
 #. type: Content of: <refsect1><refsect2><refsect3><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:256 sssd-ldap.5.xml:1371 sssd-ldap.5.xml:1383
 #: sssd-ldap.5.xml:1465 sssd-ldap.5.xml:2351 sssd-ldap.5.xml:2378
-#: sssd-krb5.5.xml:408 include/ldap_id_mapping.xml:145
+#: sssd-krb5.5.xml:401 include/ldap_id_mapping.xml:145
 #: include/ldap_id_mapping.xml:156
 msgid "Default: not set"
 msgstr ""
@@ -499,8 +500,8 @@ msgstr ""
 #: sssd.conf.5.xml:292 sssd.conf.5.xml:472 sssd.conf.5.xml:819
 #: sssd-ldap.5.xml:1538 sssd-ldap.5.xml:1635 sssd-ldap.5.xml:1697
 #: sssd-ldap.5.xml:2139 sssd-ldap.5.xml:2204 sssd-ldap.5.xml:2222
-#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:191
-#: sssd-ad.5.xml:279 sssd-krb5.5.xml:497
+#: sssd-ipa.5.xml:361 sssd-ipa.5.xml:396 sssd-ad.5.xml:166 sssd-ad.5.xml:250
+#: sssd-ad.5.xml:338 sssd-krb5.5.xml:490
 msgid "Default: true"
 msgstr ""
 
@@ -519,7 +520,7 @@ msgstr ""
 #: sssd-ldap.5.xml:640 sssd-ldap.5.xml:1412 sssd-ldap.5.xml:1431
 #: sssd-ldap.5.xml:1607 sssd-ldap.5.xml:1935 sssd-ipa.5.xml:139
 #: sssd-ipa.5.xml:205 sssd-ipa.5.xml:474 sssd-ipa.5.xml:492
-#: sssd-krb5.5.xml:264 sssd-krb5.5.xml:298 sssd-krb5.5.xml:469
+#: sssd-krb5.5.xml:257 sssd-krb5.5.xml:291 sssd-krb5.5.xml:462
 msgid "Default: false"
 msgstr ""
 
@@ -2017,7 +2018,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd.conf.5.xml:1710 sssd-ldap.5.xml:1097 sssd-ldap.5.xml:1139
-#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:246
+#: sssd-ldap.5.xml:1154 sssd-krb5.5.xml:239
 msgid "Default: 6"
 msgstr ""
 
@@ -2061,7 +2062,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd.conf.5.xml:1746 sssd-ad.5.xml:249
+#: sssd.conf.5.xml:1746 sssd-ad.5.xml:308
 msgid "Default: True"
 msgstr ""
 
@@ -2320,7 +2321,7 @@ msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
 #: sssd.conf.5.xml:1965 sssd-ldap.5.xml:2404 sssd-simple.5.xml:131
-#: sssd-ipa.5.xml:759 sssd-ad.5.xml:298 sssd-krb5.5.xml:526
+#: sssd-ipa.5.xml:759 sssd-ad.5.xml:357 sssd-krb5.5.xml:519
 msgid "EXAMPLE"
 msgstr ""
 
@@ -2496,7 +2497,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:126
+#: sssd-ldap.5.xml:126 sssd-ad.5.xml:212
 msgid "Examples:"
 msgstr ""
 
@@ -4001,7 +4002,7 @@ msgid "Specifies the lifetime in seconds of the TGT if GSSAPI is used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:235
+#: sssd-ldap.5.xml:1551 sssd-ad.5.xml:294
 msgid "Default: 86400 (24 hours)"
 msgstr ""
 
@@ -4054,7 +4055,7 @@ msgid "Default: System defaults, see <filename>/etc/krb5.conf</filename>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:460
+#: sssd-ldap.5.xml:1598 sssd-ipa.5.xml:386 sssd-krb5.5.xml:453
 msgid "krb5_canonicalize (boolean)"
 msgstr ""
 
@@ -4066,12 +4067,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:475
+#: sssd-ldap.5.xml:1613 sssd-krb5.5.xml:468
 msgid "krb5_use_kdcinfo (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:478
+#: sssd-ldap.5.xml:1616 sssd-krb5.5.xml:471
 msgid ""
 "Specifies if the SSSD should instruct the Kerberos libraries what realm and "
 "which KDCs to use. This option is on by default, if you disable it, you need "
@@ -4081,7 +4082,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:489
+#: sssd-ldap.5.xml:1627 sssd-krb5.5.xml:482
 msgid ""
 "See the <citerefentry> <refentrytitle>sssd_krb5_locator_plugin</"
 "refentrytitle> <manvolnum>8</manvolnum> </citerefentry> manual page for more "
@@ -4961,13 +4962,13 @@ msgstr ""
 
 #. type: Content of: <refsect1><refsect2><para>
 #: sssd-ldap.5.xml:2411 sssd-simple.5.xml:139 sssd-ipa.5.xml:767
-#: sssd-ad.5.xml:306 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:535
+#: sssd-ad.5.xml:365 sssd-sudo.5.xml:56 sssd-sudo.5.xml:98 sssd-krb5.5.xml:528
 #: include/ldap_id_mapping.xml:63
 msgid "<placeholder type=\"programlisting\" id=\"0\"/>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><title>
-#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:321
+#: sssd-ldap.5.xml:2424 sssd_krb5_locator_plugin.8.xml:61 sssd-ad.5.xml:380
 #: sssd.8.xml:191 sss_seed.8.xml:163
 msgid "NOTES"
 msgstr ""
@@ -5408,7 +5409,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:116 sssd-ad.5.xml:172
+#: sssd-ipa.5.xml:116 sssd-ad.5.xml:231
 msgid "dyndns_update (boolean)"
 msgstr ""
 
@@ -5423,7 +5424,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:128 sssd-ad.5.xml:186
+#: sssd-ipa.5.xml:128 sssd-ad.5.xml:245
 msgid ""
 "NOTE: On older systems (such as RHEL 5), for this behavior to work reliably, "
 "the default Kerberos realm must be set properly in /etc/krb5.conf"
@@ -5438,12 +5439,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:145 sssd-ad.5.xml:197
+#: sssd-ipa.5.xml:145 sssd-ad.5.xml:256
 msgid "dyndns_ttl (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:148 sssd-ad.5.xml:200
+#: sssd-ipa.5.xml:148 sssd-ad.5.xml:259
 msgid ""
 "The TTL to apply to the client DNS record when updating it.  If "
 "dyndns_update is false this has no effect. This will override the TTL "
@@ -5464,12 +5465,12 @@ msgid "Default: 1200 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:165 sssd-ad.5.xml:211
+#: sssd-ipa.5.xml:165 sssd-ad.5.xml:270
 msgid "dyndns_iface (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:168 sssd-ad.5.xml:214
+#: sssd-ipa.5.xml:168 sssd-ad.5.xml:273
 msgid ""
 "Optional. Applicable only when dyndns_update is true. Choose the interface "
 "whose IP address should be used for dynamic DNS updates."
@@ -5511,12 +5512,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:211 sssd-ad.5.xml:225
+#: sssd-ipa.5.xml:211 sssd-ad.5.xml:284
 msgid "dyndns_refresh_interval (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:214 sssd-ad.5.xml:228
+#: sssd-ipa.5.xml:214 sssd-ad.5.xml:287
 msgid ""
 "How often should the back end perform periodic DNS update in addition to the "
 "automatic update performed when the back end goes online.  This option is "
@@ -5524,12 +5525,12 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:227 sssd-ad.5.xml:241
+#: sssd-ipa.5.xml:227 sssd-ad.5.xml:300
 msgid "dyndns_update_ptr (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:230 sssd-ad.5.xml:244
+#: sssd-ipa.5.xml:230 sssd-ad.5.xml:303
 msgid ""
 "Whether the PTR record should also be explicitly updated when updating the "
 "client's DNS records.  Applicable only when dyndns_update is true."
@@ -5548,19 +5549,19 @@ msgid "Default: False (disabled)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:247 sssd-ad.5.xml:255
+#: sssd-ipa.5.xml:247 sssd-ad.5.xml:314
 msgid "dyndns_force_tcp (bool)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:250 sssd-ad.5.xml:258
+#: sssd-ipa.5.xml:250 sssd-ad.5.xml:317
 msgid ""
 "Whether the nsupdate utility should default to using TCP for communicating "
 "with the DNS server."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:254 sssd-ad.5.xml:262
+#: sssd-ipa.5.xml:254 sssd-ad.5.xml:321
 msgid "Default: False (let nsupdate choose the protocol)"
 msgstr ""
 
@@ -5651,7 +5652,7 @@ msgid "Default: the value of <emphasis>cn=ad,cn=etc,%basedn</emphasis>"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:252
+#: sssd-ipa.5.xml:354 sssd-krb5.5.xml:245
 msgid "krb5_validate (boolean)"
 msgstr ""
 
@@ -5663,7 +5664,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ipa.5.xml:364 sssd-ad.5.xml:282
+#: sssd-ipa.5.xml:364 sssd-ad.5.xml:341
 msgid ""
 "Note that this default differs from the traditional Kerberos provider back "
 "end."
@@ -6271,9 +6272,79 @@ msgid ""
 "discovery as well."
 msgstr ""
 
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
+#: sssd-ad.5.xml:172
+msgid "ad_access_filter (boolean)"
+msgstr ""
+
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
 #: sssd-ad.5.xml:175
 msgid ""
+"This option specifies LDAP access control filter that the user must match in "
+"order to be allowed access. Please note that the <quote>access_filter</"
+"quote> option must be explicitly set to <quote>ad</quote> in order for this "
+"option to have an effect."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:183
+msgid ""
+"The option also supports specifying different filters per domain or forest. "
+"This extended filter would consist of: <quote>KEYWORD:NAME:FILTER</quote>.  "
+"The keyword can be either <quote>DOM</quote>, <quote>FOREST</quote> or "
+"missing."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:191
+msgid ""
+"If the keyword equals to <quote>DOM</quote> or is missing, then <quote>NAME</"
+"quote> specifies the domain or subdomain the filter applies to.  If the "
+"keyword equals to <quote>FOREST</quote>, then the filter equals to all "
+"domains from the forest specified by <quote>NAME</quote>."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:199
+msgid ""
+"Multiple filters can be separated with the <quote>?</quote> character, "
+"similarly to how search bases work."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:204
+msgid ""
+"The most specific match is always used. For example, if the option specified "
+"filter for a domain the user is a member of and a global filter, the per-"
+"domain filter would be applied.  If there are more matches with the same "
+"specification, the first one is used."
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><programlisting>
+#: sssd-ad.5.xml:215
+#, no-wrap
+msgid ""
+"# apply filter on domain called dom1 only:\n"
+"dom1:(memberOf=cn=admins,ou=groups,dc=dom1,dc=com)\n"
+"\n"
+"# apply filter on domain called dom2 only:\n"
+"DOM:dom2:(memberOf=cn=admins,ou=groups,dc=dom2,dc=com)\n"
+"\n"
+"# apply filter on forest called EXAMPLE.COM only:\n"
+"FOREST:EXAMPLE.COM:(memberOf=cn=admins,ou=groups,dc=example,dc=com)\n"
+"                        "
+msgstr ""
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:225
+#, fuzzy
+#| msgid "Default: 3"
+msgid "Default: Not set"
+msgstr "默认： 3"
+
+#. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
+#: sssd-ad.5.xml:234
+msgid ""
 "Optional. This option tells SSSD to automatically update the Active "
 "Directory DNS server with the IP address of this client. The update is "
 "secured using GSS-TSIG. As a consequence, the Active Directory administrator "
@@ -6283,29 +6354,29 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:205
+#: sssd-ad.5.xml:264
 msgid "Default: 3600 (seconds)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:219
+#: sssd-ad.5.xml:278
 msgid "Default: Use the IP address of the AD LDAP connection"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-ad.5.xml:270 sssd-krb5.5.xml:503
+#: sssd-ad.5.xml:329 sssd-krb5.5.xml:496
 msgid "krb5_use_enterprise_principal (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-ad.5.xml:273 sssd-krb5.5.xml:506
+#: sssd-ad.5.xml:332 sssd-krb5.5.xml:499
 msgid ""
 "Specifies if the user principal should be treated as enterprise principal. "
 "See section 5 of RFC 6806 for more details about enterprise principals."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:300
+#: sssd-ad.5.xml:359
 msgid ""
 "The following example assumes that SSSD is correctly configured and example."
 "com is one of the domains in the <replaceable>[sssd]</replaceable> section. "
@@ -6313,7 +6384,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:307
+#: sssd-ad.5.xml:366
 #, no-wrap
 msgid ""
 "[domain/EXAMPLE]\n"
@@ -6328,7 +6399,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-ad.5.xml:327
+#: sssd-ad.5.xml:386
 #, no-wrap
 msgid ""
 "access_provider = ldap\n"
@@ -6337,7 +6408,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:323
+#: sssd-ad.5.xml:382
 msgid ""
 "The AD access control provider checks if the account is expired.  It has the "
 "same effect as the following configuration of the LDAP provider: "
@@ -6345,7 +6416,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-ad.5.xml:333
+#: sssd-ad.5.xml:392
 msgid ""
 "However, unless the <quote>ad</quote> access control provider is explicitly "
 "configured, the default access provider is <quote>permit</quote>."
@@ -7102,106 +7173,102 @@ msgstr ""
 #: sssd-krb5.5.xml:138
 msgid ""
 "Directory to store credential caches. All the substitution sequences of "
-"krb5_ccname_template can be used here, too, except %d and %P. If the "
-"directory does not exist, it will be created. If %u, %U, %p or %h are used, "
-"a private directory belonging to the user is created. Otherwise, a public "
-"directory with restricted deletion flag (aka sticky bit, as described in "
-"<citerefentry> <refentrytitle>chmod</refentrytitle> <manvolnum>1</manvolnum> "
-"</citerefentry> for details) is created."
+"krb5_ccname_template can be used here, too, except %d and %P.  The directory "
+"is created as private and owned by the user, with permissions set to 0700."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:152
+#: sssd-krb5.5.xml:145
 msgid "Default: /tmp"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:158
+#: sssd-krb5.5.xml:151
 msgid "krb5_ccname_template (string)"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:172 include/override_homedir.xml:11
+#: sssd-krb5.5.xml:165 include/override_homedir.xml:11
 msgid "%u"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:173 include/override_homedir.xml:12
+#: sssd-krb5.5.xml:166 include/override_homedir.xml:12
 msgid "login name"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:176 include/override_homedir.xml:15
+#: sssd-krb5.5.xml:169 include/override_homedir.xml:15
 msgid "%U"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:177
+#: sssd-krb5.5.xml:170
 msgid "login UID"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:180
+#: sssd-krb5.5.xml:173
 msgid "%p"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:181
+#: sssd-krb5.5.xml:174
 msgid "principal name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:185
+#: sssd-krb5.5.xml:178
 msgid "%r"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:186
+#: sssd-krb5.5.xml:179
 msgid "realm name"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:189
+#: sssd-krb5.5.xml:182
 msgid "%h"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:190
+#: sssd-krb5.5.xml:183
 msgid "home directory"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:194 include/override_homedir.xml:19
+#: sssd-krb5.5.xml:187 include/override_homedir.xml:19
 msgid "%d"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:195
+#: sssd-krb5.5.xml:188
 msgid "value of krb5ccache_dir"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:200
+#: sssd-krb5.5.xml:193
 msgid "%P"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:201
+#: sssd-krb5.5.xml:194
 msgid "the process ID of the SSSD client"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:206 include/override_homedir.xml:34
+#: sssd-krb5.5.xml:199 include/override_homedir.xml:34
 msgid "%%"
 msgstr ""
 
 #. type: Content of: <varlistentry><listitem><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:207 include/override_homedir.xml:35
+#: sssd-krb5.5.xml:200 include/override_homedir.xml:35
 msgid "a literal '%'"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:161
+#: sssd-krb5.5.xml:154
 msgid ""
 "Location of the user's credential cache. Three credential cache types are "
 "currently supported: <quote>FILE</quote>, <quote>DIR</quote> and "
@@ -7214,7 +7281,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:215
+#: sssd-krb5.5.xml:208
 msgid ""
 "When using KEYRING types, the only supported mechanism is <quote>KEYRING:"
 "persistent:%U</quote>, which uses the Linux kernel keyring to store "
@@ -7223,7 +7290,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:223
+#: sssd-krb5.5.xml:216
 msgid ""
 "The default value for the credential cache name is sourced from the profile "
 "stored in the system wide krb5.conf configuration file in the [libdefaults] "
@@ -7233,17 +7300,17 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:232
+#: sssd-krb5.5.xml:225
 msgid "Default: (from libkrb5)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:238
+#: sssd-krb5.5.xml:231
 msgid "krb5_auth_timeout (integer)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:241
+#: sssd-krb5.5.xml:234
 msgid ""
 "Timeout in seconds after an online authentication request or change password "
 "request is aborted. If possible, the authentication request is continued "
@@ -7251,7 +7318,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:255
+#: sssd-krb5.5.xml:248
 msgid ""
 "Verify with the help of krb5_keytab that the TGT obtained has not been "
 "spoofed. The keytab is checked for entries sequentially, and the first entry "
@@ -7262,36 +7329,36 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:270
+#: sssd-krb5.5.xml:263
 msgid "krb5_keytab (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:273
+#: sssd-krb5.5.xml:266
 msgid ""
 "The location of the keytab to use when validating credentials obtained from "
 "KDCs."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:277
+#: sssd-krb5.5.xml:270
 msgid "Default: /etc/krb5.keytab"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:283
+#: sssd-krb5.5.xml:276
 msgid "krb5_store_password_if_offline (boolean)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:286
+#: sssd-krb5.5.xml:279
 msgid ""
 "Store the password of the user if the provider is offline and use it to "
 "request a TGT when the provider comes online again."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:291
+#: sssd-krb5.5.xml:284
 msgid ""
 "NOTE: this feature is only available on Linux.  Passwords stored in this way "
 "are kept in plaintext in the kernel keyring and are potentially accessible "
@@ -7299,91 +7366,91 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:304
+#: sssd-krb5.5.xml:297
 msgid "krb5_renewable_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:307
+#: sssd-krb5.5.xml:300
 msgid ""
 "Request a renewable ticket with a total lifetime, given as an integer "
 "immediately followed by a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:312 sssd-krb5.5.xml:346 sssd-krb5.5.xml:383
+#: sssd-krb5.5.xml:305 sssd-krb5.5.xml:339 sssd-krb5.5.xml:376
 msgid "<emphasis>s</emphasis> for seconds"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:315 sssd-krb5.5.xml:349 sssd-krb5.5.xml:386
+#: sssd-krb5.5.xml:308 sssd-krb5.5.xml:342 sssd-krb5.5.xml:379
 msgid "<emphasis>m</emphasis> for minutes"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:318 sssd-krb5.5.xml:352 sssd-krb5.5.xml:389
+#: sssd-krb5.5.xml:311 sssd-krb5.5.xml:345 sssd-krb5.5.xml:382
 msgid "<emphasis>h</emphasis> for hours"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:355 sssd-krb5.5.xml:392
+#: sssd-krb5.5.xml:314 sssd-krb5.5.xml:348 sssd-krb5.5.xml:385
 msgid "<emphasis>d</emphasis> for days."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:324 sssd-krb5.5.xml:395
+#: sssd-krb5.5.xml:317 sssd-krb5.5.xml:388
 msgid "If there is no unit given, <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:328 sssd-krb5.5.xml:399
+#: sssd-krb5.5.xml:321 sssd-krb5.5.xml:392
 msgid ""
 "NOTE: It is not possible to mix units.  To set the renewable lifetime to one "
 "and a half hours, use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:333
+#: sssd-krb5.5.xml:326
 msgid "Default: not set, i.e. the TGT is not renewable"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:339
+#: sssd-krb5.5.xml:332
 msgid "krb5_lifetime (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:342
+#: sssd-krb5.5.xml:335
 msgid ""
 "Request ticket with a lifetime, given as an integer immediately followed by "
 "a time unit:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:358
+#: sssd-krb5.5.xml:351
 msgid "If there is no unit given <emphasis>s</emphasis> is assumed."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:362
+#: sssd-krb5.5.xml:355
 msgid ""
 "NOTE: It is not possible to mix units.  To set the lifetime to one and a "
 "half hours please use '90m' instead of '1h30m'."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:367
+#: sssd-krb5.5.xml:360
 msgid ""
 "Default: not set, i.e. the default ticket lifetime configured on the KDC."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:374
+#: sssd-krb5.5.xml:367
 msgid "krb5_renew_interval (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:377
+#: sssd-krb5.5.xml:370
 msgid ""
 "The time in seconds between two checks if the TGT should be renewed. TGTs "
 "are renewed if about half of their lifetime is exceeded, given as an integer "
@@ -7391,55 +7458,55 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:404
+#: sssd-krb5.5.xml:397
 msgid "If this option is not set or is 0 the automatic renewal is disabled."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:414
+#: sssd-krb5.5.xml:407
 msgid "krb5_use_fast (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:417
+#: sssd-krb5.5.xml:410
 msgid ""
 "Enables flexible authentication secure tunneling (FAST) for Kerberos pre-"
 "authentication. The following options are supported:"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:422
+#: sssd-krb5.5.xml:415
 msgid ""
 "<emphasis>never</emphasis> use FAST. This is equivalent to not setting this "
 "option at all."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:426
+#: sssd-krb5.5.xml:419
 msgid ""
 "<emphasis>try</emphasis> to use FAST. If the server does not support FAST, "
 "continue the authentication without it."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:431
+#: sssd-krb5.5.xml:424
 msgid ""
 "<emphasis>demand</emphasis> to use FAST. The authentication fails if the "
 "server does not require fast."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:436
+#: sssd-krb5.5.xml:429
 msgid "Default: not set, i.e. FAST is not used."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:439
+#: sssd-krb5.5.xml:432
 msgid "NOTE: a keytab is required to use FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:442
+#: sssd-krb5.5.xml:435
 msgid ""
 "NOTE: SSSD supports FAST only with MIT Kerberos version 1.8 and later. If "
 "SSSD is used with an older version of MIT Kerberos, using this option is a "
@@ -7447,24 +7514,24 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><term>
-#: sssd-krb5.5.xml:451
+#: sssd-krb5.5.xml:444
 msgid "krb5_fast_principal (string)"
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:454
+#: sssd-krb5.5.xml:447
 msgid "Specifies the server principal to use for FAST."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:463
+#: sssd-krb5.5.xml:456
 msgid ""
 "Specifies if the host and user principal should be canonicalized. This "
 "feature is available with MIT Kerberos 1.7 and later versions."
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><variablelist><varlistentry><listitem><para>
-#: sssd-krb5.5.xml:512
+#: sssd-krb5.5.xml:505
 msgid "Default: false (AD provide: true)"
 msgstr ""
 
@@ -7479,7 +7546,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para>
-#: sssd-krb5.5.xml:528
+#: sssd-krb5.5.xml:521
 msgid ""
 "The following example assumes that SSSD is correctly configured and FOO is "
 "one of the domains in the <replaceable>[sssd]</replaceable> section. This "
@@ -7488,7 +7555,7 @@ msgid ""
 msgstr ""
 
 #. type: Content of: <reference><refentry><refsect1><para><programlisting>
-#: sssd-krb5.5.xml:536
+#: sssd-krb5.5.xml:529
 #, no-wrap
 msgid ""
 "    [domain/FOO]\n"
@@ -8599,104 +8666,118 @@ msgstr ""
 #. type: Content of: <listitem><para>
 #: include/debug_levels.xml:3
 msgid ""
-"Bit mask that indicates which debug levels will be visible. 0x0010 is the "
-"default value as well as the lowest allowed value, 0xFFF0 is the most "
-"verbose mode. This setting overrides the settings from config file."
+"SSSD supports two representations for specifying the debug level. The "
+"simplest is to specify a decimal value from 0-9, which represents enabling "
+"that level and all lower-level debug messages. The more comprehensive option "
+"is to specify a hexadecimal bitmask to enable or disable specific levels "
+"(such as if you wish to suppress a level)."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:8
+#: include/debug_levels.xml:10
 msgid "Currently supported debug levels:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:11
+#: include/debug_levels.xml:13
 msgid ""
-"<emphasis>0x0010</emphasis>: Fatal failures. Anything that would prevent "
-"SSSD from starting up or causes it to cease running."
+"<emphasis>0</emphasis>, <emphasis>0x0010</emphasis>: Fatal failures. "
+"Anything that would prevent SSSD from starting up or causes it to cease "
+"running."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:15
+#: include/debug_levels.xml:19
 msgid ""
-"<emphasis>0x0020</emphasis>: Critical failures. An error that doesn't kill "
-"the SSSD, but one that indicates that at least one major feature is not "
-"going to work properly."
+"<emphasis>1</emphasis>, <emphasis>0x0020</emphasis>: Critical failures. An "
+"error that doesn't kill the SSSD, but one that indicates that at least one "
+"major feature is not going to work properly."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:20
+#: include/debug_levels.xml:26
 msgid ""
-"<emphasis>0x0040</emphasis>: Serious failures. An error announcing that a "
-"particular request or operation has failed."
+"<emphasis>2</emphasis>, <emphasis>0x0040</emphasis>: Serious failures. An "
+"error announcing that a particular request or operation has failed."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:24
+#: include/debug_levels.xml:31
 msgid ""
-"<emphasis>0x0080</emphasis>: Minor failures. These are the errors that would "
-"percolate down to cause the operation failure of 2."
+"<emphasis>3</emphasis>, <emphasis>0x0080</emphasis>: Minor failures. These "
+"are the errors that would percolate down to cause the operation failure of 2."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:28
-msgid "<emphasis>0x0100</emphasis>: Configuration settings."
+#: include/debug_levels.xml:36
+msgid ""
+"<emphasis>4</emphasis>, <emphasis>0x0100</emphasis>: Configuration settings."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:31
-msgid "<emphasis>0x0200</emphasis>: Function data."
+#: include/debug_levels.xml:40
+msgid "<emphasis>5</emphasis>, <emphasis>0x0200</emphasis>: Function data."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:34
-msgid "<emphasis>0x0400</emphasis>: Trace messages for operation functions."
+#: include/debug_levels.xml:44
+msgid ""
+"<emphasis>6</emphasis>, <emphasis>0x0400</emphasis>: Trace messages for "
+"operation functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:37
+#: include/debug_levels.xml:48
 msgid ""
-"<emphasis>0x1000</emphasis>: Trace messages for internal control functions."
+"<emphasis>7</emphasis>, <emphasis>0x1000</emphasis>: Trace messages for "
+"internal control functions."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:40
+#: include/debug_levels.xml:53
 msgid ""
-"<emphasis>0x2000</emphasis>: Contents of function-internal variables that "
-"may be interesting."
+"<emphasis>8</emphasis>, <emphasis>0x2000</emphasis>: Contents of function-"
+"internal variables that may be interesting."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:43
-msgid "<emphasis>0x4000</emphasis>: Extremely low-level tracing information."
+#: include/debug_levels.xml:58
+msgid ""
+"<emphasis>9</emphasis>, <emphasis>0x4000</emphasis>: Extremely low-level "
+"tracing information."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:46
+#: include/debug_levels.xml:62
 msgid ""
-"To log required debug levels, simply add their numbers together as shown in "
-"following examples:"
+"To log required bitmask debug levels, simply add their numbers together as "
+"shown in following examples:"
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:49
+#: include/debug_levels.xml:66
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, critical failures, "
 "serious failures and function data use 0x0270."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:53
+#: include/debug_levels.xml:70
 msgid ""
 "<emphasis>Example</emphasis>: To log fatal failures, configuration settings, "
 "function data, trace messages for internal control functions use 0x1310."
 msgstr ""
 
 #. type: Content of: <listitem><para>
-#: include/debug_levels.xml:57
+#: include/debug_levels.xml:75
 msgid ""
-"<emphasis>Note</emphasis>: This is new format of debug levels introduced in "
-"1.7.0.  Older format (numbers from 0-10) is compatible but deprecated."
+"<emphasis>Note</emphasis>: The bitmask format of debug levels was introduced "
+"in 1.7.0."
+msgstr ""
+
+#. type: Content of: <listitem><para>
+#: include/debug_levels.xml:79
+msgid "<emphasis>Default</emphasis>: 0"
 msgstr ""
 
 #. type: Content of: outside any tag (error?)