translations: Update ipa.pot file

Reviewed-By: Petr Vobornik <pvoborni@redhat.com>

1 files changed, 3592 insertions, 2903 deletions

diff --git a/install/po/ipa.pot b/install/po/ipa.pot
index 336be52da..8256bb77d 100644
--- a/install/po/ipa.pot
+++ b/install/po/ipa.pot
@@ -9,7 +9,7 @@ msgstr ""
 "Project-Id-Version: ipa\n"
 "Report-Msgid-Bugs-To: https://hosted.fedoraproject.org/projects/freeipa/"
 "newticket\n"
-"POT-Creation-Date: 2015-06-24 13:48+0200\n"
+"POT-Creation-Date: 2015-12-02 11:14+0100\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -19,58 +19,58 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=INTEGER; plural=EXPRESSION;\n"
 
-#: ipalib/cli.py:599
+#: ipalib/cli.py:608
 #, python-format
 msgid "Enter %(label)s again to verify: "
 msgstr ""
 
-#: ipalib/cli.py:607 ipa-client/ipa-getkeytab.c:587
+#: ipalib/cli.py:616 ipa-client/ipa-getkeytab.c:588
 #, c-format
 msgid "Passwords do not match!"
 msgstr ""
 
-#: ipalib/cli.py:630
+#: ipalib/cli.py:639
 msgid "No matching entries found"
 msgstr ""
 
-#: ipalib/cli.py:674
+#: ipalib/cli.py:683
 msgid "Topic or Command"
 msgstr ""
 
-#: ipalib/cli.py:675
+#: ipalib/cli.py:684
 msgid "The topic or command name."
 msgstr ""
 
-#: ipalib/cli.py:847
+#: ipalib/cli.py:855
 msgid "Topic commands:"
 msgstr ""
 
-#: ipalib/cli.py:852
+#: ipalib/cli.py:860
 msgid "To get command help, use:"
 msgstr ""
 
-#: ipalib/cli.py:853
+#: ipalib/cli.py:861
 msgid "  ipa <command> --help"
 msgstr ""
 
-#: ipalib/cli.py:862
+#: ipalib/cli.py:870
 msgid "Command name"
 msgstr ""
 
-#: ipalib/cli.py:1030
+#: ipalib/cli.py:1038
 msgid "Positional arguments"
 msgstr ""
 
-#: ipalib/cli.py:1178
+#: ipalib/cli.py:1185
 #, python-format
 msgid "Same as --%s"
 msgstr ""
 
-#: ipalib/cli.py:1181
+#: ipalib/cli.py:1188
 msgid "Deprecated options"
 msgstr ""
 
-#: ipalib/cli.py:1303
+#: ipalib/cli.py:1310
 msgid "No file to read"
 msgstr ""
 
@@ -78,470 +78,470 @@ msgstr ""
 msgid "A string searched in all relevant object attributes"
 msgstr ""
 
-#: ipalib/errors.py:270
+#: ipalib/errors.py:281
 #, python-format
 msgid "%(cver)s client incompatible with %(sver)s server at '%(server)s'"
 msgstr ""
 
-#: ipalib/errors.py:288
+#: ipalib/errors.py:299
 #, python-format
 msgid "unknown error %(code)d from %(server)s: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:304
+#: ipalib/errors.py:315
 msgid "an internal error has occurred"
 msgstr ""
 
-#: ipalib/errors.py:326
+#: ipalib/errors.py:337
 #, python-format
 msgid "an internal error has occurred on server at '%(server)s'"
 msgstr ""
 
-#: ipalib/errors.py:342
+#: ipalib/errors.py:353
 #, python-format
 msgid "unknown command '%(name)s'"
 msgstr ""
 
-#: ipalib/errors.py:359 ipalib/errors.py:384
+#: ipalib/errors.py:370 ipalib/errors.py:395
 #, python-format
 msgid "error on server '%(server)s': %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:375
+#: ipalib/errors.py:386
 #, python-format
 msgid "cannot connect to '%(uri)s': %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:393
+#: ipalib/errors.py:404
 #, python-format
 msgid "Invalid JSON-RPC request: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:409
+#: ipalib/errors.py:420
 #, python-format
 msgid "error marshalling data for XML-RPC transport: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:425
+#: ipalib/errors.py:436
 #, python-format
 msgid "Missing or invalid HTTP Referer, %(referer)s"
 msgstr ""
 
-#: ipalib/errors.py:452
+#: ipalib/errors.py:463
 #, python-format
 msgid "Kerberos error: %(major)s/%(minor)s"
 msgstr ""
 
-#: ipalib/errors.py:469
+#: ipalib/errors.py:480
 msgid "did not receive Kerberos credentials"
 msgstr ""
 
-#: ipalib/errors.py:485
+#: ipalib/errors.py:496
 #, python-format
 msgid "Service '%(service)s' not found in Kerberos database"
 msgstr ""
 
-#: ipalib/errors.py:501
+#: ipalib/errors.py:512
 msgid "No credentials cache found"
 msgstr ""
 
-#: ipalib/errors.py:517
+#: ipalib/errors.py:528
 msgid "Ticket expired"
 msgstr ""
 
-#: ipalib/errors.py:533
+#: ipalib/errors.py:544
 msgid "Credentials cache permissions incorrect"
 msgstr ""
 
-#: ipalib/errors.py:549
+#: ipalib/errors.py:560
 msgid "Bad format in credentials cache"
 msgstr ""
 
-#: ipalib/errors.py:565
+#: ipalib/errors.py:576
 msgid "Cannot resolve KDC for requested realm"
 msgstr ""
 
-#: ipalib/errors.py:577
+#: ipalib/errors.py:588
 msgid "Session error"
 msgstr ""
 
-#: ipalib/errors.py:585
+#: ipalib/errors.py:596
 #, python-format
 msgid "Principal %(principal)s cannot be authenticated: %(message)s"
 msgstr ""
 
-#: ipalib/errors.py:609
+#: ipalib/errors.py:620
 #, python-format
 msgid "Insufficient access: %(info)s"
 msgstr ""
 
-#: ipalib/errors.py:653
+#: ipalib/errors.py:664
 #, python-format
 msgid "command '%(name)s' takes no arguments"
 msgstr ""
 
-#: ipalib/errors.py:673
+#: ipalib/errors.py:684
 #, python-format
 msgid "command '%(name)s' takes at most %(count)d argument"
 msgid_plural "command '%(name)s' takes at most %(count)d arguments"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/errors.py:703
+#: ipalib/errors.py:714
 #, python-format
 msgid "overlapping arguments and options: %(names)s"
 msgstr ""
 
-#: ipalib/errors.py:719
+#: ipalib/errors.py:730
 #, python-format
 msgid "'%(name)s' is required"
 msgstr ""
 
-#: ipalib/errors.py:735 ipalib/errors.py:751
+#: ipalib/errors.py:746 ipalib/errors.py:762
 #, python-format
 msgid "invalid '%(name)s': %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:767
+#: ipalib/errors.py:778
 #, python-format
 msgid "api has no such namespace: '%(name)s'"
 msgstr ""
 
-#: ipalib/errors.py:776
+#: ipalib/errors.py:787
 msgid "Passwords do not match"
 msgstr ""
 
-#: ipalib/errors.py:785
+#: ipalib/errors.py:796
 msgid "Command not implemented"
 msgstr ""
 
-#: ipalib/errors.py:794
+#: ipalib/errors.py:805
 msgid "Client is not configured. Run ipa-client-install."
 msgstr ""
 
-#: ipalib/errors.py:803
+#: ipalib/errors.py:814
 #, python-format
 msgid "Could not get %(name)s interactively"
 msgstr ""
 
-#: ipalib/errors.py:818
+#: ipalib/errors.py:829
 #, python-format
 msgid "Command '%(name)s' has been deprecated"
 msgstr ""
 
-#: ipalib/errors.py:834
+#: ipalib/errors.py:845
 #, python-format
 msgid "Domain '%(domain)s' is not a root domain for forest '%(forest)s'"
 msgstr ""
 
-#: ipalib/errors.py:862 ipalib/errors.py:1102 ipalib/errors.py:1196
-#: ipalib/errors.py:1658 ipalib/errors.py:1675
+#: ipalib/errors.py:873 ipalib/errors.py:1113 ipalib/errors.py:1207
+#: ipalib/errors.py:1373 ipalib/errors.py:1670 ipalib/errors.py:1687
 #, python-format
 msgid "%(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:878
+#: ipalib/errors.py:889
 msgid "This entry already exists"
 msgstr ""
 
-#: ipalib/errors.py:894
+#: ipalib/errors.py:905
 msgid "You must enroll a host in order to create a host service"
 msgstr ""
 
-#: ipalib/errors.py:910
+#: ipalib/errors.py:921
 #, python-format
 msgid ""
 "Service principal is not of the form: service/fully-qualified host name: "
 "%(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:926
+#: ipalib/errors.py:937
 msgid ""
 "The realm for the principal does not match the realm for this IPA server"
 msgstr ""
 
-#: ipalib/errors.py:942
+#: ipalib/errors.py:953
 msgid "This command requires root access"
 msgstr ""
 
-#: ipalib/errors.py:958
+#: ipalib/errors.py:969
 msgid "This is already a posix group"
 msgstr ""
 
-#: ipalib/errors.py:974
+#: ipalib/errors.py:985
 #, python-format
 msgid "Principal is not of the form user@REALM: '%(principal)s'"
 msgstr ""
 
-#: ipalib/errors.py:990
+#: ipalib/errors.py:1001
 msgid "This entry is already enabled"
 msgstr ""
 
-#: ipalib/errors.py:1006
+#: ipalib/errors.py:1017
 msgid "This entry is already disabled"
 msgstr ""
 
-#: ipalib/errors.py:1022
+#: ipalib/errors.py:1033
 msgid "This entry cannot be enabled or disabled"
 msgstr ""
 
-#: ipalib/errors.py:1038
+#: ipalib/errors.py:1049
 msgid "This entry is not a member"
 msgstr ""
 
-#: ipalib/errors.py:1054
+#: ipalib/errors.py:1065
 msgid "A group may not be a member of itself"
 msgstr ""
 
-#: ipalib/errors.py:1070
+#: ipalib/errors.py:1081
 msgid "This entry is already a member"
 msgstr ""
 
-#: ipalib/errors.py:1086
+#: ipalib/errors.py:1097
 #, python-format
 msgid "Base64 decoding failed: %(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:1118
+#: ipalib/errors.py:1129
 msgid "A group may not be added as a member of itself"
 msgstr ""
 
-#: ipalib/errors.py:1134
+#: ipalib/errors.py:1145
 msgid "The default users group cannot be removed"
 msgstr ""
 
-#: ipalib/errors.py:1150
+#: ipalib/errors.py:1161
 msgid "Host does not have corresponding DNS A/AAAA record"
 msgstr ""
 
-#: ipalib/errors.py:1165
+#: ipalib/errors.py:1176
 msgid "Deleting a managed group is not allowed. It must be detached first."
 msgstr ""
 
-#: ipalib/errors.py:1180
+#: ipalib/errors.py:1191
 msgid "A managed group cannot have a password policy."
 msgstr ""
 
-#: ipalib/errors.py:1212
+#: ipalib/errors.py:1223
 #, python-format
 msgid "'%(entry)s' doesn't have a certificate."
 msgstr ""
 
-#: ipalib/errors.py:1228
+#: ipalib/errors.py:1239
 #, python-format
 msgid "Unable to create private group. A group '%(group)s' already exists."
 msgstr ""
 
-#: ipalib/errors.py:1244
+#: ipalib/errors.py:1255
 #, python-format
 msgid ""
 "A problem was encountered when verifying that all members were %(verb)s: "
 "%(exc)s"
 msgstr ""
 
-#: ipalib/errors.py:1262
+#: ipalib/errors.py:1273
 #, python-format
 msgid "%(attr)s does not contain '%(value)s'"
 msgstr ""
 
-#: ipalib/errors.py:1279
+#: ipalib/errors.py:1290
 #, python-format
 msgid ""
 "The search criteria was not specific enough. Expected 1 and found %(found)d."
 msgstr ""
 
-#: ipalib/errors.py:1296
+#: ipalib/errors.py:1307
 msgid "This group already allows external members"
 msgstr ""
 
-#: ipalib/errors.py:1313
+#: ipalib/errors.py:1324
 msgid "This group cannot be posix because it is external"
 msgstr ""
 
-#: ipalib/errors.py:1330
+#: ipalib/errors.py:1341
 msgid "This is already a posix group and cannot be converted to external one"
 msgstr ""
 
-#: ipalib/errors.py:1384
+#: ipalib/errors.py:1396
 #, python-format
 msgid "no command nor help topic '%(topic)s'"
 msgstr ""
 
-#: ipalib/errors.py:1408
+#: ipalib/errors.py:1420
 msgid "change collided with another change"
 msgstr ""
 
-#: ipalib/errors.py:1424
+#: ipalib/errors.py:1436
 msgid "no modifications to be performed"
 msgstr ""
 
-#: ipalib/errors.py:1440
+#: ipalib/errors.py:1452
 #, python-format
 msgid "%(desc)s: %(info)s"
 msgstr ""
 
-#: ipalib/errors.py:1456
+#: ipalib/errors.py:1468
 msgid "limits exceeded for this query"
 msgstr ""
 
-#: ipalib/errors.py:1471
+#: ipalib/errors.py:1483
 #, python-format
 msgid "%(info)s"
 msgstr ""
 
-#: ipalib/errors.py:1486
+#: ipalib/errors.py:1498
 msgid "modifying primary key is not allowed"
 msgstr ""
 
-#: ipalib/errors.py:1502
+#: ipalib/errors.py:1514
 #, python-format
 msgid "%(attr)s: Only one value allowed."
 msgstr ""
 
-#: ipalib/errors.py:1518
+#: ipalib/errors.py:1530
 #, python-format
 msgid "%(attr)s: Invalid syntax."
 msgstr ""
 
-#: ipalib/errors.py:1534
+#: ipalib/errors.py:1546
 #, python-format
 msgid "Bad search filter %(info)s"
 msgstr ""
 
-#: ipalib/errors.py:1550
+#: ipalib/errors.py:1562
 msgid "Not allowed on non-leaf entry"
 msgstr ""
 
-#: ipalib/errors.py:1566
+#: ipalib/errors.py:1578
 msgid "LDAP timeout"
 msgstr ""
 
-#: ipalib/errors.py:1584
+#: ipalib/errors.py:1596
 #, python-format
 msgid "DNS check failed: Expected {%(expected)s} got {%(got)s}"
 msgstr ""
 
-#: ipalib/errors.py:1600
+#: ipalib/errors.py:1612
 #, python-format
 msgid "%(task)s LDAP task timeout, Task DN: '%(task_dn)s'"
 msgstr ""
 
-#: ipalib/errors.py:1625
+#: ipalib/errors.py:1637
 #, python-format
 msgid "Certificate operation cannot be completed: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:1641
+#: ipalib/errors.py:1653
 #, python-format
 msgid "Certificate format error: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:1692
+#: ipalib/errors.py:1704
 msgid "Already registered"
 msgstr ""
 
-#: ipalib/errors.py:1708
+#: ipalib/errors.py:1720
 msgid "Not registered yet"
 msgstr ""
 
-#: ipalib/errors.py:1724
+#: ipalib/errors.py:1736
 #, python-format
 msgid "%(key)s cannot be deleted because %(label)s %(dependent)s requires it"
 msgstr ""
 
-#: ipalib/errors.py:1740
+#: ipalib/errors.py:1752
 #, python-format
 msgid ""
 "%(key)s cannot be deleted or disabled because it is the last member of "
 "%(label)s %(container)s"
 msgstr ""
 
-#: ipalib/errors.py:1756
+#: ipalib/errors.py:1768
 #, python-format
 msgid "%(label)s %(key)s cannot be deleted/modified: %(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:1773
+#: ipalib/errors.py:1785
 #, python-format
 msgid "%(name)s certificate is not valid"
 msgstr ""
 
-#: ipalib/frontend.py:416
+#: ipalib/frontend.py:418
 msgid "Results are truncated, try a more specific search"
 msgstr ""
 
-#: ipalib/frontend.py:541
+#: ipalib/frontend.py:545
 #, python-format
 msgid "Unknown option: %(option)s"
 msgstr ""
 
-#: ipalib/frontend.py:904
+#: ipalib/frontend.py:908
 msgid ""
 "Retrieve and print all attributes from the server. Affects command output."
 msgstr ""
 
-#: ipalib/frontend.py:910
+#: ipalib/frontend.py:914
 msgid "Print entries as stored on the server. Only affects output format."
 msgstr ""
 
-#: ipalib/frontend.py:916 ipalib/plugins/batch.py:73
+#: ipalib/frontend.py:920 ipalib/plugins/batch.py:78
 msgid "Client version. Used to determine if server will accept request."
 msgstr ""
 
-#: ipalib/frontend.py:1093
+#: ipalib/frontend.py:1082
 msgid "Forward to server instead of running locally"
 msgstr ""
 
-#: ipalib/messages.py:73
+#: ipalib/messages.py:78
 msgid "Additional instructions:"
 msgstr ""
 
-#: ipalib/messages.py:134
+#: ipalib/messages.py:144
 #, python-format
 msgid ""
 "API Version number was not sent, forward compatibility not guaranteed. "
 "Assuming server's API version, %(server_version)s"
 msgstr ""
 
-#: ipalib/messages.py:146
+#: ipalib/messages.py:156
 msgid ""
 "DNS forwarder semantics changed since IPA 4.0.\n"
 "You may want to use forward zones (dnsforwardzone-*) instead.\n"
 "For more details read the docs."
 msgstr ""
 
-#: ipalib/messages.py:158
+#: ipalib/messages.py:168
 #, python-format
 msgid ""
 "DNSSEC support is experimental.\n"
 "%(additional_info)s"
 msgstr ""
 
-#: ipalib/messages.py:168
+#: ipalib/messages.py:178
 #, python-format
 msgid "'%(option)s' option is deprecated. %(additional_info)s"
 msgstr ""
 
-#: ipalib/messages.py:178
+#: ipalib/messages.py:188
 #, python-format
 msgid ""
 "Semantic of %(label)s was changed. %(current_behavior)s\n"
 "%(hint)s"
 msgstr ""
 
-#: ipalib/messages.py:189
+#: ipalib/messages.py:199
 #, python-format
 msgid "DNS server %(server)s: %(error)s."
 msgstr ""
 
-#: ipalib/messages.py:199
+#: ipalib/messages.py:209
 #, python-format
 msgid ""
 "DNS server %(server)s does not support DNSSEC: %(error)s.\n"
 "If DNSSEC validation is enabled on IPA server(s), please disable it."
 msgstr ""
 
-#: ipalib/messages.py:212
+#: ipalib/messages.py:222
 #, python-format
 msgid ""
 "forward zone \"%(fwzone)s\" is not effective because of missing proper NS "
@@ -549,14 +549,14 @@ msgid ""
 "\"%(ns_rec)s\" to parent zone \"%(authzone)s\"."
 msgstr ""
 
-#: ipalib/messages.py:226
+#: ipalib/messages.py:236
 #, python-format
 msgid ""
 "DNS server %(server)s does not support EDNS0 (RFC 6891): %(error)s.\n"
 "If DNSSEC validation is enabled on IPA server(s), please disable it."
 msgstr ""
 
-#: ipalib/messages.py:239
+#: ipalib/messages.py:249
 #, python-format
 msgid ""
 "DNSSEC validation failed: %(error)s.\n"
@@ -564,388 +564,426 @@ msgid ""
 "IPA servers."
 msgstr ""
 
-#: ipalib/output.py:93
+#: ipalib/messages.py:263
+#, python-format
+msgid ""
+"The _kerberos TXT record from domain %(domain)s could not be created "
+"(%(error)s).\n"
+"This can happen if the zone is not managed by IPA. Please create the record "
+"manually, containing the following value: '%(realm)s'"
+msgstr ""
+
+#: ipalib/messages.py:279
+#, python-format
+msgid ""
+"The _kerberos TXT record from domain %(domain)s could not be removed "
+"(%(error)s).\n"
+"This can happen if the zone is not managed by IPA. Please remove the record "
+"manually."
+msgstr ""
+
+#: ipalib/messages.py:293
+msgid ""
+"No DNSSEC key master is installed. DNSSEC zone signing will not work until "
+"the DNSSEC key master is installed."
+msgstr ""
+
+#: ipalib/messages.py:308
+#, python-format
+msgid ""
+"Relative record name '%(record)s' contains the zone name '%(zone)s' as a "
+"suffix, which results in FQDN '%(fqdn)s'. This is usually a mistake caused "
+"by a missing dot at the end of the name specification."
+msgstr ""
+
+#: ipalib/messages.py:321
+#, python-format
+msgid "'%(command)s' is deprecated. %(additional_info)s"
+msgstr ""
+
+#: ipalib/output.py:97
 msgid "A dictionary representing an LDAP entry"
 msgstr ""
 
-#: ipalib/output.py:101
+#: ipalib/output.py:105
 msgid "A list of LDAP entries"
 msgstr ""
 
-#: ipalib/output.py:153
+#: ipalib/output.py:157
 msgid "All commands should at least have a result"
 msgstr ""
 
-#: ipalib/output.py:156
+#: ipalib/output.py:160
 msgid "User-friendly description of action performed"
 msgstr ""
 
-#: ipalib/output.py:160
+#: ipalib/output.py:164
 msgid "The primary_key value of the entry, e.g. 'jdoe' for a user"
 msgstr ""
 
-#: ipalib/output.py:175
+#: ipalib/output.py:179
 msgid "Number of entries returned"
 msgstr ""
 
-#: ipalib/output.py:176
+#: ipalib/output.py:180
 msgid "True if not all results were returned"
 msgstr ""
 
-#: ipalib/output.py:181 ipalib/output.py:187
+#: ipalib/output.py:185 ipalib/output.py:191
 msgid "List of deletions that failed"
 msgstr ""
 
-#: ipalib/output.py:193 ipalib/plugins/dns.py:313
+#: ipalib/output.py:197 ipalib/plugins/dns.py:318
 msgid "True means the operation was successful"
 msgstr ""
 
-#: ipalib/parameters.py:382
+#: ipalib/parameters.py:390
 msgid "incorrect type"
 msgstr ""
 
-#: ipalib/parameters.py:385
+#: ipalib/parameters.py:393
 msgid "Only one value is allowed"
 msgstr ""
 
-#: ipalib/parameters.py:953
+#: ipalib/parameters.py:955
 msgid "must be True or False"
 msgstr ""
 
-#: ipalib/parameters.py:1055
+#: ipalib/parameters.py:1057
 msgid "must be an integer"
 msgstr ""
 
-#: ipalib/parameters.py:1103
+#: ipalib/parameters.py:1108
 #, python-format
 msgid "must be at least %(minvalue)d"
 msgstr ""
 
-#: ipalib/parameters.py:1113
+#: ipalib/parameters.py:1118
 #, python-format
 msgid "can be at most %(maxvalue)d"
 msgstr ""
 
-#: ipalib/parameters.py:1129
+#: ipalib/parameters.py:1134
 msgid "must be a decimal number"
 msgstr ""
 
-#: ipalib/parameters.py:1175
+#: ipalib/parameters.py:1180
 #, python-format
 msgid "must be at least %(minvalue)s"
 msgstr ""
 
-#: ipalib/parameters.py:1185
+#: ipalib/parameters.py:1190
 #, python-format
 msgid "can be at most %(maxvalue)s"
 msgstr ""
 
-#: ipalib/parameters.py:1193
+#: ipalib/parameters.py:1198
 #, python-format
 msgid ""
 "number class '%(cls)s' is not included in a list of allowed number classes: "
 "%(allowed)s"
 msgstr ""
 
-#: ipalib/parameters.py:1317
+#: ipalib/parameters.py:1321
 #, python-format
 msgid "must match pattern \"%(pattern)s\""
 msgstr ""
 
-#: ipalib/parameters.py:1335
+#: ipalib/parameters.py:1339
 msgid "must be binary data"
 msgstr ""
 
-#: ipalib/parameters.py:1351
+#: ipalib/parameters.py:1358
 #, python-format
 msgid "must be at least %(minlength)d bytes"
 msgstr ""
 
-#: ipalib/parameters.py:1361
+#: ipalib/parameters.py:1368
 #, python-format
 msgid "can be at most %(maxlength)d bytes"
 msgstr ""
 
-#: ipalib/parameters.py:1371
+#: ipalib/parameters.py:1378
 #, python-format
 msgid "must be exactly %(length)d bytes"
 msgstr ""
 
-#: ipalib/parameters.py:1401
+#: ipalib/parameters.py:1409
 msgid "must be Unicode text"
 msgstr ""
 
-#: ipalib/parameters.py:1434
+#: ipalib/parameters.py:1442
 msgid "Leading and trailing spaces are not allowed"
 msgstr ""
 
-#: ipalib/parameters.py:1442
+#: ipalib/parameters.py:1450
 #, python-format
 msgid "must be at least %(minlength)d characters"
 msgstr ""
 
-#: ipalib/parameters.py:1452
+#: ipalib/parameters.py:1460
 #, python-format
 msgid "can be at most %(maxlength)d characters"
 msgstr ""
 
-#: ipalib/parameters.py:1462
+#: ipalib/parameters.py:1470
 #, python-format
 msgid "must be exactly %(length)d characters"
 msgstr ""
 
-#: ipalib/parameters.py:1483
+#: ipalib/parameters.py:1491
 #, python-format
 msgid "The character %(char)r is not allowed."
 msgstr ""
 
-#: ipalib/parameters.py:1534
+#: ipalib/parameters.py:1542
 #, python-format
 msgid "must be '%(value)s'"
 msgstr ""
 
-#: ipalib/parameters.py:1537
+#: ipalib/parameters.py:1545
 #, python-format
 msgid "must be one of %(values)s"
 msgstr ""
 
-#: ipalib/parameters.py:1647
+#: ipalib/parameters.py:1655
 msgid "must be datetime value"
 msgstr ""
 
-#: ipalib/parameters.py:1661
+#: ipalib/parameters.py:1669
 msgid "does not match any of accepted formats: "
 msgstr ""
 
-#: ipalib/parameters.py:1846
+#: ipalib/parameters.py:1854
 msgid "incomplete time value"
 msgstr ""
 
-#: ipalib/parameters.py:1883
+#: ipalib/parameters.py:1891
 msgid "this option is deprecated"
 msgstr ""
 
-#: ipalib/parameters.py:1936
+#: ipalib/parameters.py:1944
 msgid "must be DNS name"
 msgstr ""
 
-#: ipalib/parameters.py:1966
+#: ipalib/parameters.py:1974
 msgid "must be absolute"
 msgstr ""
 
-#: ipalib/parameters.py:1970
+#: ipalib/parameters.py:1978
 msgid "must be relative"
 msgstr ""
 
-#: ipalib/plugins/aci.py:157
+#: ipalib/plugins/aci.py:162
 msgid "A list of ACI values"
 msgstr ""
 
-#: ipalib/plugins/aci.py:221
+#: ipalib/plugins/aci.py:226
 msgid "type, filter, subtree and targetgroup are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/aci.py:224
+#: ipalib/plugins/aci.py:229
 msgid "ACI prefix is required"
 msgstr ""
 
-#: ipalib/plugins/aci.py:227
+#: ipalib/plugins/aci.py:232
 msgid ""
 "at least one of: type, filter, subtree, targetgroup, attrs or memberof are "
 "required"
 msgstr ""
 
-#: ipalib/plugins/aci.py:230
+#: ipalib/plugins/aci.py:235
 msgid "filter and memberof are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/aci.py:236
+#: ipalib/plugins/aci.py:241
 msgid "group, permission and self are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/aci.py:238
+#: ipalib/plugins/aci.py:243
 msgid "One of group, permission or self is required"
 msgstr ""
 
-#: ipalib/plugins/aci.py:261
+#: ipalib/plugins/aci.py:266
 #, python-format
 msgid "Group '%s' does not exist"
 msgstr ""
 
-#: ipalib/plugins/aci.py:287
+#: ipalib/plugins/aci.py:292
 msgid "empty filter"
 msgstr ""
 
-#: ipalib/plugins/aci.py:308
+#: ipalib/plugins/aci.py:313
 #, python-format
 msgid "Syntax Error: %(error)s"
 msgstr ""
 
-#: ipalib/plugins/aci.py:354
+#: ipalib/plugins/aci.py:357
 #, python-format
 msgid "invalid DN (%s)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:401
+#: ipalib/plugins/aci.py:404
 #, python-format
 msgid "ACI with name \"%s\" not found"
 msgstr ""
 
-#: ipalib/plugins/aci.py:419
+#: ipalib/plugins/aci.py:422
 msgid "ACI prefix"
 msgstr ""
 
-#: ipalib/plugins/aci.py:420
+#: ipalib/plugins/aci.py:423
 msgid ""
 "Prefix used to distinguish ACI types (permission, delegation, selfservice, "
 "none)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:433
+#: ipalib/plugins/aci.py:436
 msgid "ACIs"
 msgstr ""
 
-#: ipalib/plugins/aci.py:438
+#: ipalib/plugins/aci.py:441
 msgid "ACI name"
 msgstr ""
 
-#: ipalib/plugins/aci.py:444 ipalib/plugins/permission.py:219
+#: ipalib/plugins/aci.py:447 ipalib/plugins/permission.py:225
 msgid "Permission"
 msgstr ""
 
-#: ipalib/plugins/aci.py:445
+#: ipalib/plugins/aci.py:448
 msgid "Permission ACI grants access to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:450 ipalib/plugins/delegation.py:105
+#: ipalib/plugins/aci.py:453 ipalib/plugins/delegation.py:105
 msgid "User group"
 msgstr ""
 
-#: ipalib/plugins/aci.py:451 ipalib/plugins/delegation.py:106
+#: ipalib/plugins/aci.py:454 ipalib/plugins/delegation.py:106
 msgid "User group ACI grants access to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:456 ipalib/plugins/baseldap.py:67
-#: ipalib/plugins/delegation.py:87 ipalib/plugins/permission.py:218
+#: ipalib/plugins/aci.py:459 ipalib/plugins/baseldap.py:72
+#: ipalib/plugins/delegation.py:87 ipalib/plugins/permission.py:224
 #: ipalib/plugins/selfservice.py:91
 msgid "Permissions"
 msgstr ""
 
-#: ipalib/plugins/aci.py:457
+#: ipalib/plugins/aci.py:460
 msgid "Permissions to grant(read, write, add, delete, all)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:465
+#: ipalib/plugins/aci.py:468
 msgid "Attributes to which the permission applies"
 msgstr ""
 
-#: ipalib/plugins/aci.py:466 ipalib/plugins/delegation.py:93
+#: ipalib/plugins/aci.py:469 ipalib/plugins/delegation.py:93
 #: ipalib/plugins/selfservice.py:97
 msgid "Attributes"
 msgstr ""
 
-#: ipalib/plugins/aci.py:472 ipalib/plugins/otptoken.py:160
-#: ipalib/plugins/permission.py:333
+#: ipalib/plugins/aci.py:475 ipalib/plugins/otptoken.py:164
+#: ipalib/plugins/permission.py:339 ipalib/plugins/vault.py:634
+#: ipalib/plugins/vault.py:907
 msgid "Type"
 msgstr ""
 
-#: ipalib/plugins/aci.py:473
+#: ipalib/plugins/aci.py:476
 msgid "type of IPA object (user, group, host, hostgroup, service, netgroup)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:479
+#: ipalib/plugins/aci.py:482
 msgid "Member of"
 msgstr ""
 
-#: ipalib/plugins/aci.py:480
+#: ipalib/plugins/aci.py:483
 msgid "Member of a group"
 msgstr ""
 
-#: ipalib/plugins/aci.py:485 ipalib/plugins/internal.py:216
-#: ipalib/plugins/internal.py:591
+#: ipalib/plugins/aci.py:488 ipalib/plugins/internal.py:217
+#: ipalib/plugins/internal.py:610
 msgid "Filter"
 msgstr ""
 
-#: ipalib/plugins/aci.py:486
+#: ipalib/plugins/aci.py:489
 msgid "Legal LDAP filter (e.g. ou=Engineering)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:491 ipalib/plugins/permission.py:278
+#: ipalib/plugins/aci.py:494 ipalib/plugins/permission.py:284
 msgid "Subtree"
 msgstr ""
 
-#: ipalib/plugins/aci.py:492
+#: ipalib/plugins/aci.py:495
 msgid "Subtree to apply ACI to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:497 ipalib/plugins/permission.py:327
+#: ipalib/plugins/aci.py:500 ipalib/plugins/permission.py:333
 msgid "Target group"
 msgstr ""
 
-#: ipalib/plugins/aci.py:498
+#: ipalib/plugins/aci.py:501
 msgid "Group to apply ACI to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:503
+#: ipalib/plugins/aci.py:506
 msgid "Target your own entry (self)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:504
+#: ipalib/plugins/aci.py:507
 msgid "Apply ACI to your own entry (self)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:516
+#: ipalib/plugins/aci.py:519
 #, python-format
 msgid "Created ACI \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/aci.py:521
+#: ipalib/plugins/aci.py:524
 msgid "Test the ACI syntax but don't write anything"
 msgstr ""
 
-#: ipalib/plugins/aci.py:571
+#: ipalib/plugins/aci.py:574
 #, python-format
 msgid "Deleted ACI \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/aci.py:613 ipalib/plugins/aci.py:888
-#: ipalib/plugins/aci.py:934 ipalib/plugins/delegation.py:62
-#: ipalib/plugins/permission.py:112 ipalib/plugins/selfservice.py:63
+#: ipalib/plugins/aci.py:616 ipalib/plugins/aci.py:891
+#: ipalib/plugins/aci.py:937 ipalib/plugins/delegation.py:62
+#: ipalib/plugins/permission.py:118 ipalib/plugins/selfservice.py:63
 msgid "ACI"
 msgstr ""
 
-#: ipalib/plugins/aci.py:621
+#: ipalib/plugins/aci.py:624
 #, python-format
 msgid "Modified ACI \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/aci.py:695
+#: ipalib/plugins/aci.py:698
 #, python-format
 msgid "%(count)d ACI matched"
 msgid_plural "%(count)d ACIs matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/aci.py:895
+#: ipalib/plugins/aci.py:898
 msgid "Location of the ACI"
 msgstr ""
 
-#: ipalib/plugins/aci.py:941
+#: ipalib/plugins/aci.py:944
 msgid "New ACI name"
 msgstr ""
 
-#: ipalib/plugins/aci.py:945
+#: ipalib/plugins/aci.py:948
 #, python-format
 msgid "Renamed ACI to \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:30
+#: ipalib/plugins/automember.py:34
 msgid ""
 "\n"
 "Auto Membership Rule.\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:32
+#: ipalib/plugins/automember.py:36
 msgid ""
 "\n"
 "Bring clarity to the membership of hosts and users by configuring inclusive\n"
@@ -954,14 +992,14 @@ msgid ""
 "a group or hostgroup based upon attribute information.\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:36
+#: ipalib/plugins/automember.py:40
 msgid ""
 "\n"
 "A rule is directly associated with a group by name, so you cannot create\n"
 "a rule without an accompanying group or hostgroup.\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:39
+#: ipalib/plugins/automember.py:43
 msgid ""
 "\n"
 "A condition is a regular expression used by 389-ds to match a new incoming\n"
@@ -969,7 +1007,7 @@ msgid ""
 "entry is added to the appropriate group or hostgroup.\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:43
+#: ipalib/plugins/automember.py:47
 msgid ""
 "\n"
 "A default group or hostgroup could be specified for entries that do not\n"
@@ -977,7 +1015,7 @@ msgid ""
 "because all users are by default members of group specified in IPA config.\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:47
+#: ipalib/plugins/automember.py:51
 msgid ""
 "\n"
 "The automember-rebuild command can be used to retroactively run automember "
@@ -985,17 +1023,17 @@ msgid ""
 "against existing entries, thus rebuilding their membership.\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:50 ipalib/plugins/host.py:80
-#: ipalib/plugins/otptoken.py:46 ipalib/plugins/otptoken_yubikey.py:38
-#: ipalib/plugins/permission.py:90 ipalib/plugins/radiusproxy.py:35
-#: ipalib/plugins/server.py:19 ipalib/plugins/sudorule.py:66
-#: ipalib/plugins/vault.py:52
+#: ipalib/plugins/automember.py:54 ipalib/plugins/host.py:87
+#: ipalib/plugins/otptoken.py:50 ipalib/plugins/otptoken_yubikey.py:42
+#: ipalib/plugins/permission.py:96 ipalib/plugins/radiusproxy.py:35
+#: ipalib/plugins/server.py:19 ipalib/plugins/sudorule.py:70
+#: ipalib/plugins/vault.py:95
 msgid ""
 "\n"
 "EXAMPLES:\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:52
+#: ipalib/plugins/automember.py:56
 msgid ""
 "\n"
 " Add the initial group or hostgroup:\n"
@@ -1003,7 +1041,7 @@ msgid ""
 "   ipa group-add --desc=\"Developers\" devel\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:56
+#: ipalib/plugins/automember.py:60
 msgid ""
 "\n"
 " Add the initial rule:\n"
@@ -1011,7 +1049,7 @@ msgid ""
 "   ipa automember-add --type=group devel\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:60
+#: ipalib/plugins/automember.py:64
 msgid ""
 "\n"
 " Add a condition to the rule:\n"
@@ -1021,7 +1059,7 @@ msgid ""
 "regex=^uid=mscott devel\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:64
+#: ipalib/plugins/automember.py:68
 msgid ""
 "\n"
 " Add an exclusive condition to the rule to prevent auto assignment:\n"
@@ -1029,21 +1067,21 @@ msgid ""
 "regex=^web5\\.example\\.com webservers\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:67
+#: ipalib/plugins/automember.py:71
 msgid ""
 "\n"
 " Add a host:\n"
 "    ipa host-add web1.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:70
+#: ipalib/plugins/automember.py:74
 msgid ""
 "\n"
 " Add a user:\n"
 "    ipa user-add --first=Tim --last=User --password tuser1 --manager=mscott\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:73
+#: ipalib/plugins/automember.py:77
 msgid ""
 "\n"
 " Verify automembership:\n"
@@ -1059,7 +1097,7 @@ msgid ""
 "      Member users: tuser\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:85
+#: ipalib/plugins/automember.py:89
 msgid ""
 "\n"
 " Remove a condition from the rule:\n"
@@ -1067,14 +1105,14 @@ msgid ""
 "regex=^web[1-9]+\\.example\\.com webservers\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:88
+#: ipalib/plugins/automember.py:92
 msgid ""
 "\n"
 " Modify the automember rule:\n"
 "    ipa automember-mod\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:91
+#: ipalib/plugins/automember.py:95
 msgid ""
 "\n"
 " Set the default (fallback) target group:\n"
@@ -1083,7 +1121,7 @@ msgid ""
 "    ipa automember-default-group-set --default-group=ipausers --type=group\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:95
+#: ipalib/plugins/automember.py:99
 msgid ""
 "\n"
 " Remove the default (fallback) target group:\n"
@@ -1091,7 +1129,7 @@ msgid ""
 "    ipa automember-default-group-remove --type=group\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:99
+#: ipalib/plugins/automember.py:103
 msgid ""
 "\n"
 " Show the default (fallback) target group:\n"
@@ -1099,14 +1137,14 @@ msgid ""
 "    ipa automember-default-group-show --type=group\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:103
+#: ipalib/plugins/automember.py:107
 msgid ""
 "\n"
 " Find all of the automember rules:\n"
 "    ipa automember-find\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:106
+#: ipalib/plugins/automember.py:110
 msgid ""
 "\n"
 " Display a automember rule:\n"
@@ -1114,7 +1152,7 @@ msgid ""
 "    ipa automember-show --type=group devel\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:110
+#: ipalib/plugins/automember.py:114
 msgid ""
 "\n"
 " Delete an automember rule:\n"
@@ -1122,28 +1160,28 @@ msgid ""
 "    ipa automember-del --type=group devel\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:114
+#: ipalib/plugins/automember.py:118
 msgid ""
 "\n"
 " Rebuild membership for all users:\n"
 "    ipa automember-rebuild --type=group\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:117
+#: ipalib/plugins/automember.py:121
 msgid ""
 "\n"
 " Rebuild membership for all hosts:\n"
 "    ipa automember-rebuild --type=hostgroup\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:120
+#: ipalib/plugins/automember.py:124
 msgid ""
 "\n"
 " Rebuild membership for specified users:\n"
 "    ipa automember-rebuild --users=tuser1 --users=tuser2\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:123
+#: ipalib/plugins/automember.py:127
 msgid ""
 "\n"
 " Rebuild membership for specified hosts:\n"
@@ -1151,122 +1189,122 @@ msgid ""
 "com\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:142 ipalib/plugins/automember.py:143
+#: ipalib/plugins/automember.py:146 ipalib/plugins/automember.py:147
 msgid "Inclusive Regex"
 msgstr ""
 
-#: ipalib/plugins/automember.py:149 ipalib/plugins/automember.py:150
+#: ipalib/plugins/automember.py:153 ipalib/plugins/automember.py:154
 msgid "Exclusive Regex"
 msgstr ""
 
-#: ipalib/plugins/automember.py:155
+#: ipalib/plugins/automember.py:159
 msgid "Attribute Key"
 msgstr ""
 
-#: ipalib/plugins/automember.py:156
+#: ipalib/plugins/automember.py:160
 msgid ""
 "Attribute to filter via regex. For example fqdn for a host, or manager for a "
 "user"
 msgstr ""
 
-#: ipalib/plugins/automember.py:163
+#: ipalib/plugins/automember.py:167
 msgid "Grouping Type"
 msgstr ""
 
-#: ipalib/plugins/automember.py:164
+#: ipalib/plugins/automember.py:168
 msgid "Grouping to which the rule applies"
 msgstr ""
 
-#: ipalib/plugins/automember.py:172 ipalib/plugins/automember.py:173
+#: ipalib/plugins/automember.py:176 ipalib/plugins/automember.py:177
 msgid "Automember Rule"
 msgstr ""
 
-#: ipalib/plugins/automember.py:232
+#: ipalib/plugins/automember.py:236
 msgid "Auto Membership Rule"
 msgstr ""
 
-#: ipalib/plugins/automember.py:237 ipalib/plugins/automount.py:600
-#: ipalib/plugins/caacl.py:222 ipalib/plugins/group.py:242
+#: ipalib/plugins/automember.py:241 ipalib/plugins/automount.py:605
+#: ipalib/plugins/caacl.py:223 ipalib/plugins/group.py:249
 #: ipalib/plugins/hbacrule.py:233 ipalib/plugins/hbacsvc.py:108
-#: ipalib/plugins/hbacsvcgroup.py:112 ipalib/plugins/host.py:459
-#: ipalib/plugins/hostgroup.py:156 ipalib/plugins/idviews.py:82
-#: ipalib/plugins/idviews.py:553 ipalib/plugins/netgroup.py:189
-#: ipalib/plugins/otptoken.py:169 ipalib/plugins/privilege.py:107
+#: ipalib/plugins/hbacsvcgroup.py:112 ipalib/plugins/host.py:466
+#: ipalib/plugins/hostgroup.py:162 ipalib/plugins/idviews.py:105
+#: ipalib/plugins/idviews.py:653 ipalib/plugins/netgroup.py:197
+#: ipalib/plugins/otptoken.py:173 ipalib/plugins/privilege.py:132
 #: ipalib/plugins/radiusproxy.py:109 ipalib/plugins/role.py:141
 #: ipalib/plugins/selinuxusermap.py:227 ipalib/plugins/sudocmd.py:119
-#: ipalib/plugins/sudocmdgroup.py:122 ipalib/plugins/sudorule.py:223
-#: ipalib/plugins/vault.py:195
+#: ipalib/plugins/sudocmdgroup.py:122 ipalib/plugins/sudorule.py:227
+#: ipalib/plugins/vault.py:628
 msgid "Description"
 msgstr ""
 
-#: ipalib/plugins/automember.py:238
+#: ipalib/plugins/automember.py:242
 msgid "A description of this auto member rule"
 msgstr ""
 
-#: ipalib/plugins/automember.py:242 ipalib/plugins/automember.py:568
+#: ipalib/plugins/automember.py:246 ipalib/plugins/automember.py:572
 msgid "Default (fallback) Group"
 msgstr ""
 
-#: ipalib/plugins/automember.py:243
+#: ipalib/plugins/automember.py:247
 msgid "Default group for entries to land"
 msgstr ""
 
-#: ipalib/plugins/automember.py:255
+#: ipalib/plugins/automember.py:259
 #, python-format
 msgid "%(otype)s \"%(oname)s\" not found"
 msgstr ""
 
-#: ipalib/plugins/automember.py:281
+#: ipalib/plugins/automember.py:285
 #, python-format
 msgid "%s is not a valid attribute."
 msgstr ""
 
-#: ipalib/plugins/automember.py:294
+#: ipalib/plugins/automember.py:298
 msgid ""
 "\n"
 "    Add an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:299
+#: ipalib/plugins/automember.py:303
 #, python-format
 msgid "Added automember rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:306
+#: ipalib/plugins/automember.py:310
 msgid "Auto Membership is not configured"
 msgstr ""
 
-#: ipalib/plugins/automember.py:318
+#: ipalib/plugins/automember.py:322
 msgid ""
 "\n"
 "    Add conditions to an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:323
+#: ipalib/plugins/automember.py:327
 msgid "Failed to add"
 msgstr ""
 
-#: ipalib/plugins/automember.py:330
+#: ipalib/plugins/automember.py:334
 #, python-format
 msgid "Added condition(s) to \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:339
+#: ipalib/plugins/automember.py:343
 msgid "Conditions that could not be added"
 msgstr ""
 
-#: ipalib/plugins/automember.py:343
+#: ipalib/plugins/automember.py:347
 msgid "Number of conditions added"
 msgstr ""
 
-#: ipalib/plugins/automember.py:353 ipalib/plugins/automember.py:438
+#: ipalib/plugins/automember.py:357 ipalib/plugins/automember.py:442
 #, python-format
 msgid "Auto member rule: %s not found!"
 msgstr ""
 
-#: ipalib/plugins/automember.py:395
+#: ipalib/plugins/automember.py:399
 msgid ""
 "\n"
 "        Override this so we can add completed and failed to the return "
@@ -1274,198 +1312,198 @@ msgid ""
 "        "
 msgstr ""
 
-#: ipalib/plugins/automember.py:410
+#: ipalib/plugins/automember.py:414
 msgid ""
 "\n"
 "    Remove conditions from an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:415
+#: ipalib/plugins/automember.py:419
 #, python-format
 msgid "Removed condition(s) from \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:424
+#: ipalib/plugins/automember.py:428
 msgid "Conditions that could not be removed"
 msgstr ""
 
-#: ipalib/plugins/automember.py:428
+#: ipalib/plugins/automember.py:432
 msgid "Number of conditions removed"
 msgstr ""
 
-#: ipalib/plugins/automember.py:482
+#: ipalib/plugins/automember.py:486
 msgid ""
 "\n"
 "        Override this so we can set completed and failed.\n"
 "        "
 msgstr ""
 
-#: ipalib/plugins/automember.py:497
+#: ipalib/plugins/automember.py:501
 msgid ""
 "\n"
 "    Modify an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:502
+#: ipalib/plugins/automember.py:506
 #, python-format
 msgid "Modified automember rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:512
+#: ipalib/plugins/automember.py:516
 msgid ""
 "\n"
 "    Delete an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:517
+#: ipalib/plugins/automember.py:521
 #, python-format
 msgid "Deleted automember rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:527
+#: ipalib/plugins/automember.py:531
 msgid ""
 "\n"
 "    Search for automember rules.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:534
+#: ipalib/plugins/automember.py:538
 #, python-format
 msgid "%(count)d rules matched"
 msgid_plural "%(count)d rules matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automember.py:546
+#: ipalib/plugins/automember.py:550
 msgid ""
 "\n"
 "    Display information about an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:561
+#: ipalib/plugins/automember.py:565
 msgid ""
 "\n"
 "    Set default (fallback) group for all unmatched entries.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:569
+#: ipalib/plugins/automember.py:573
 msgid "Default (fallback) group for entries to land"
 msgstr ""
 
-#: ipalib/plugins/automember.py:573
+#: ipalib/plugins/automember.py:577
 #, python-format
 msgid "Set default (fallback) group for automember \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:589
+#: ipalib/plugins/automember.py:593
 msgid ""
 "\n"
 "    Remove default (fallback) group for all unmatched entries.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:594
+#: ipalib/plugins/automember.py:598
 #, python-format
 msgid "Removed default (fallback) group for automember \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:604 ipalib/plugins/automember.py:612
-#: ipalib/plugins/automember.py:636
+#: ipalib/plugins/automember.py:608 ipalib/plugins/automember.py:616
+#: ipalib/plugins/automember.py:640
 msgid "No default (fallback) group set"
 msgstr ""
 
-#: ipalib/plugins/automember.py:623
+#: ipalib/plugins/automember.py:627
 msgid ""
 "\n"
 "    Display information about the default (fallback) automember groups.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:647
+#: ipalib/plugins/automember.py:651
 msgid "Rebuild auto membership."
 msgstr ""
 
-#: ipalib/plugins/automember.py:653
+#: ipalib/plugins/automember.py:657
 msgid "Rebuild membership for all members of a grouping"
 msgstr ""
 
-#: ipalib/plugins/automember.py:657 ipalib/plugins/baseuser.py:208
-#: ipalib/plugins/caacl.py:269 ipalib/plugins/hbacrule.py:240
-#: ipalib/plugins/internal.py:573 ipalib/plugins/selinuxusermap.py:234
-#: ipalib/plugins/sudorule.py:267 ipalib/plugins/user.py:125
+#: ipalib/plugins/automember.py:661 ipalib/plugins/baseuser.py:213
+#: ipalib/plugins/caacl.py:270 ipalib/plugins/hbacrule.py:240
+#: ipalib/plugins/internal.py:592 ipalib/plugins/selinuxusermap.py:234
+#: ipalib/plugins/sudorule.py:271 ipalib/plugins/user.py:133
 msgid "Users"
 msgstr ""
 
-#: ipalib/plugins/automember.py:658
+#: ipalib/plugins/automember.py:662
 msgid "Rebuild membership for specified users"
 msgstr ""
 
-#: ipalib/plugins/automember.py:662 ipalib/plugins/caacl.py:277
-#: ipalib/plugins/hbacrule.py:248 ipalib/plugins/host.py:447
-#: ipalib/plugins/internal.py:567 ipalib/plugins/selinuxusermap.py:242
-#: ipalib/plugins/sudorule.py:280
+#: ipalib/plugins/automember.py:666 ipalib/plugins/caacl.py:278
+#: ipalib/plugins/hbacrule.py:248 ipalib/plugins/host.py:454
+#: ipalib/plugins/internal.py:586 ipalib/plugins/selinuxusermap.py:242
+#: ipalib/plugins/sudorule.py:284
 msgid "Hosts"
 msgstr ""
 
-#: ipalib/plugins/automember.py:663
+#: ipalib/plugins/automember.py:667
 msgid "Rebuild membership for specified hosts"
 msgstr ""
 
-#: ipalib/plugins/automember.py:668
+#: ipalib/plugins/automember.py:672
 msgid "No wait"
 msgstr ""
 
-#: ipalib/plugins/automember.py:669
+#: ipalib/plugins/automember.py:673
 msgid "Don't wait for rebuilding membership"
 msgstr ""
 
-#: ipalib/plugins/automember.py:676
+#: ipalib/plugins/automember.py:680
 msgid "Task DN"
 msgstr ""
 
-#: ipalib/plugins/automember.py:677
+#: ipalib/plugins/automember.py:681
 msgid "DN of the started task"
 msgstr ""
 
-#: ipalib/plugins/automember.py:694
+#: ipalib/plugins/automember.py:698
 msgid "at least one of options: type, users, hosts must be specified"
 msgstr ""
 
-#: ipalib/plugins/automember.py:700
+#: ipalib/plugins/automember.py:704
 msgid "users and hosts cannot both be set"
 msgstr ""
 
-#: ipalib/plugins/automember.py:704
+#: ipalib/plugins/automember.py:708
 msgid "hosts cannot be set when type is 'group'"
 msgstr ""
 
-#: ipalib/plugins/automember.py:708
+#: ipalib/plugins/automember.py:712
 msgid "users cannot be set when type is 'hostgroup'"
 msgstr ""
 
-#: ipalib/plugins/automember.py:762
+#: ipalib/plugins/automember.py:766
 msgid "Automember rebuild membership task started"
 msgstr ""
 
-#: ipalib/plugins/automember.py:766 ipalib/plugins/internal.py:158
+#: ipalib/plugins/automember.py:770 ipalib/plugins/internal.py:159
 msgid "Automember rebuild membership task completed"
 msgstr ""
 
-#: ipalib/plugins/automember.py:783
+#: ipalib/plugins/automember.py:787
 #, python-format
 msgid "Task DN = '%s'"
 msgstr ""
 
-#: ipalib/plugins/automember.py:786 ipalib/plugins/internal.py:792
+#: ipalib/plugins/automember.py:790 ipalib/plugins/internal.py:812
 msgid "Automember"
 msgstr ""
 
-#: ipalib/plugins/automount.py:30
+#: ipalib/plugins/automount.py:35
 msgid ""
 "\n"
 "Automount\n"
@@ -1573,625 +1611,642 @@ msgid ""
 "    ipa automountkey-del baltimore auto.share --key=man\n"
 msgstr ""
 
-#: ipalib/plugins/automount.py:209
+#: ipalib/plugins/automount.py:214
 msgid "automount location"
 msgstr ""
 
-#: ipalib/plugins/automount.py:210
+#: ipalib/plugins/automount.py:215
 msgid "automount locations"
 msgstr ""
 
-#: ipalib/plugins/automount.py:213
+#: ipalib/plugins/automount.py:218
 msgid "Automount Locations"
 msgstr ""
 
-#: ipalib/plugins/automount.py:214
+#: ipalib/plugins/automount.py:219
 msgid "Automount Location"
 msgstr ""
 
-#: ipalib/plugins/automount.py:243 ipalib/plugins/host.py:469
+#: ipalib/plugins/automount.py:248 ipalib/plugins/host.py:476
 msgid "Location"
 msgstr ""
 
-#: ipalib/plugins/automount.py:244
+#: ipalib/plugins/automount.py:249
 msgid "Automount location name."
 msgstr ""
 
-#: ipalib/plugins/automount.py:252
+#: ipalib/plugins/automount.py:257
 msgid "Create a new automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:254
+#: ipalib/plugins/automount.py:259
 #, python-format
 msgid "Added automount location \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:272
+#: ipalib/plugins/automount.py:277
 msgid "Delete an automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:274
+#: ipalib/plugins/automount.py:279
 #, python-format
 msgid "Deleted automount location \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:279
+#: ipalib/plugins/automount.py:284
 msgid "Display an automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:284
+#: ipalib/plugins/automount.py:289
 msgid "Search for an automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:287
+#: ipalib/plugins/automount.py:292
 #, python-format
 msgid "%(count)d automount location matched"
 msgid_plural "%(count)d automount locations matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automount.py:294
+#: ipalib/plugins/automount.py:299
 msgid "Generate automount files for a specific location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:372
+#: ipalib/plugins/automount.py:377
 msgid "maps not connected to /etc/auto.master:"
 msgstr ""
 
-#: ipalib/plugins/automount.py:389
+#: ipalib/plugins/automount.py:394
 msgid "Import automount files for a specific location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:393
+#: ipalib/plugins/automount.py:398
 msgid "Master file"
 msgstr ""
 
-#: ipalib/plugins/automount.py:394
+#: ipalib/plugins/automount.py:399
 msgid "Automount master file."
 msgstr ""
 
-#: ipalib/plugins/automount.py:401
+#: ipalib/plugins/automount.py:406
 msgid ""
 "Continuous operation mode. Errors are reported but the process continues."
 msgstr ""
 
-#: ipalib/plugins/automount.py:413
+#: ipalib/plugins/automount.py:418
 #, python-format
 msgid "File %(file)s not found"
 msgstr ""
 
-#: ipalib/plugins/automount.py:465
+#: ipalib/plugins/automount.py:470
 #, python-format
 msgid "key %(key)s already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:481
+#: ipalib/plugins/automount.py:486
 #, python-format
 msgid "map %(map)s already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:585
+#: ipalib/plugins/automount.py:590
 msgid "automount map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:586
+#: ipalib/plugins/automount.py:591
 msgid "automount maps"
 msgstr ""
 
-#: ipalib/plugins/automount.py:594
+#: ipalib/plugins/automount.py:599
 msgid "Map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:595
+#: ipalib/plugins/automount.py:600
 msgid "Automount map name."
 msgstr ""
 
-#: ipalib/plugins/automount.py:629
+#: ipalib/plugins/automount.py:634
 msgid "Automount Maps"
 msgstr ""
 
-#: ipalib/plugins/automount.py:630
+#: ipalib/plugins/automount.py:635
 msgid "Automount Map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:635
+#: ipalib/plugins/automount.py:640
 msgid "Create a new automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:637
+#: ipalib/plugins/automount.py:642
 #, python-format
 msgid "Added automount map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:642
+#: ipalib/plugins/automount.py:647
 msgid "Delete an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:644
+#: ipalib/plugins/automount.py:649
 #, python-format
 msgid "Deleted automount map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:662
+#: ipalib/plugins/automount.py:667
 msgid "Modify an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:664
+#: ipalib/plugins/automount.py:669
 #, python-format
 msgid "Modified automount map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:669
+#: ipalib/plugins/automount.py:674
 msgid "Search for an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:672
+#: ipalib/plugins/automount.py:677
 #, python-format
 msgid "%(count)d automount map matched"
 msgid_plural "%(count)d automount maps matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automount.py:679
+#: ipalib/plugins/automount.py:684
 msgid "Display an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:684
+#: ipalib/plugins/automount.py:689
 msgid "Automount key object."
 msgstr ""
 
-#: ipalib/plugins/automount.py:688
+#: ipalib/plugins/automount.py:693
 msgid "automount key"
 msgstr ""
 
-#: ipalib/plugins/automount.py:689
+#: ipalib/plugins/automount.py:694
 msgid "automount keys"
 msgstr ""
 
-#: ipalib/plugins/automount.py:701 ipalib/plugins/automount.py:950
-#: ipalib/plugins/automount.py:1057 ipalib/plugins/otptoken.py:214
+#: ipalib/plugins/automount.py:706 ipalib/plugins/automount.py:955
+#: ipalib/plugins/automount.py:1062 ipalib/plugins/otptoken.py:218
 msgid "Key"
 msgstr ""
 
-#: ipalib/plugins/automount.py:702 ipalib/plugins/automount.py:951
-#: ipalib/plugins/automount.py:1058
+#: ipalib/plugins/automount.py:707 ipalib/plugins/automount.py:956
+#: ipalib/plugins/automount.py:1063
 msgid "Automount key name."
 msgstr ""
 
-#: ipalib/plugins/automount.py:707 ipalib/plugins/automount.py:955
-#: ipalib/plugins/automount.py:1062
+#: ipalib/plugins/automount.py:712 ipalib/plugins/automount.py:960
+#: ipalib/plugins/automount.py:1067
 msgid "Mount information"
 msgstr ""
 
-#: ipalib/plugins/automount.py:710
+#: ipalib/plugins/automount.py:715
 msgid "description"
 msgstr ""
 
-#: ipalib/plugins/automount.py:748
+#: ipalib/plugins/automount.py:753
 msgid "Automount Keys"
 msgstr ""
 
-#: ipalib/plugins/automount.py:749
+#: ipalib/plugins/automount.py:754
 msgid "Automount Key"
 msgstr ""
 
-#: ipalib/plugins/automount.py:750
+#: ipalib/plugins/automount.py:755
 #, python-format
 msgid ""
 "The key,info pair must be unique. A key named %(key)s with info %(info)s "
 "already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:751
+#: ipalib/plugins/automount.py:756
 #, python-format
 msgid "key named %(key)s already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:752
+#: ipalib/plugins/automount.py:757
 #, python-format
 msgid "The automount key %(key)s with info %(info)s does not exist"
 msgstr ""
 
-#: ipalib/plugins/automount.py:802
+#: ipalib/plugins/automount.py:807
 #, python-format
 msgid ""
 "More than one entry with key %(key)s found, use --info to select specific "
 "entry."
 msgstr ""
 
-#: ipalib/plugins/automount.py:861
+#: ipalib/plugins/automount.py:866
 msgid "Create a new automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:863
+#: ipalib/plugins/automount.py:868
 #, python-format
 msgid "Added automount key \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:890
+#: ipalib/plugins/automount.py:895
 msgid "Create a new indirect mount point."
 msgstr ""
 
-#: ipalib/plugins/automount.py:892
+#: ipalib/plugins/automount.py:897
 #, python-format
 msgid "Added automount indirect map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:897
+#: ipalib/plugins/automount.py:902
 msgid "Mount point"
 msgstr ""
 
-#: ipalib/plugins/automount.py:901
+#: ipalib/plugins/automount.py:906
 msgid "Parent map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:902
+#: ipalib/plugins/automount.py:907
 msgid "Name of parent automount map (default: auto.master)."
 msgstr ""
 
-#: ipalib/plugins/automount.py:916
+#: ipalib/plugins/automount.py:921
 msgid "mount point is relative to parent map, cannot begin with /"
 msgstr ""
 
-#: ipalib/plugins/automount.py:943
+#: ipalib/plugins/automount.py:948
 msgid "Delete an automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:945
+#: ipalib/plugins/automount.py:950
 #, python-format
 msgid "Deleted automount key \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:984
+#: ipalib/plugins/automount.py:989
 msgid "Modify an automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:986
+#: ipalib/plugins/automount.py:991
 #, python-format
 msgid "Modified automount key \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:993
+#: ipalib/plugins/automount.py:998
 msgid "New mount information"
 msgstr ""
 
-#: ipalib/plugins/automount.py:1042
+#: ipalib/plugins/automount.py:1047
 msgid "Search for an automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:1045
+#: ipalib/plugins/automount.py:1050
 #, python-format
 msgid "%(count)d automount key matched"
 msgid_plural "%(count)d automount keys matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automount.py:1052
+#: ipalib/plugins/automount.py:1057
 msgid "Display an automount key."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:43 ipalib/plugins/baseuser.py:276
-#: ipalib/plugins/internal.py:196 ipalib/plugins/internal.py:314
-#: ipalib/plugins/internal.py:756 ipalib/plugins/migration.py:500
-#: ipalib/plugins/otptoken.py:522
+#: ipalib/plugins/baseldap.py:48 ipalib/plugins/baseuser.py:281
+#: ipalib/plugins/internal.py:197 ipalib/plugins/internal.py:317
+#: ipalib/plugins/internal.py:776 ipalib/plugins/migration.py:505
+#: ipalib/plugins/otptoken.py:507
 msgid "Password"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:46 ipalib/plugins/servicedelegation.py:100
+#: ipalib/plugins/baseldap.py:51 ipalib/plugins/servicedelegation.py:105
 msgid "Failed members"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:49
+#: ipalib/plugins/baseldap.py:54
 msgid "Member users"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:52
+#: ipalib/plugins/baseldap.py:57
 msgid "Member groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:55
+#: ipalib/plugins/baseldap.py:60
 msgid "Member of groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:58
+#: ipalib/plugins/baseldap.py:63
 msgid "Member hosts"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:61
+#: ipalib/plugins/baseldap.py:66
 msgid "Member host-groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:64
+#: ipalib/plugins/baseldap.py:69
 msgid "Member of host-groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:73 ipalib/plugins/role.py:130
+#: ipalib/plugins/baseldap.py:78 ipalib/plugins/role.py:130
 msgid "Roles"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:76 ipalib/plugins/sudocmdgroup.py:110
+#: ipalib/plugins/baseldap.py:81 ipalib/plugins/sudocmdgroup.py:110
 #: ipalib/plugins/sudocmdgroup.py:130
 msgid "Sudo Command Groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:82
+#: ipalib/plugins/baseldap.py:87
 msgid "Granting privilege to roles"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:85
+#: ipalib/plugins/baseldap.py:90
 msgid "Member netgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:88
+#: ipalib/plugins/baseldap.py:93
 msgid "Member of netgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:91
+#: ipalib/plugins/baseldap.py:96
 msgid "Member services"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:94
+#: ipalib/plugins/baseldap.py:99
 msgid "Member service groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:100
+#: ipalib/plugins/baseldap.py:105
 msgid "Member HBAC service"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:103
+#: ipalib/plugins/baseldap.py:108
 msgid "Member HBAC service groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:118
+#: ipalib/plugins/baseldap.py:123
 msgid "Indirect Member users"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:121
+#: ipalib/plugins/baseldap.py:126
 msgid "Indirect Member groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:124
+#: ipalib/plugins/baseldap.py:129
 msgid "Indirect Member hosts"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:127
+#: ipalib/plugins/baseldap.py:132
 msgid "Indirect Member host-groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:130
+#: ipalib/plugins/baseldap.py:135
 msgid "Indirect Member of roles"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:133
+#: ipalib/plugins/baseldap.py:138
 msgid "Indirect Member permissions"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:136
+#: ipalib/plugins/baseldap.py:141
 msgid "Indirect Member HBAC service"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:139
+#: ipalib/plugins/baseldap.py:144
 msgid "Indirect Member HBAC service group"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:142
+#: ipalib/plugins/baseldap.py:147
 msgid "Indirect Member netgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:163
+#: ipalib/plugins/baseldap.py:168
 msgid "Failed source hosts/hostgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:166
+#: ipalib/plugins/baseldap.py:171
 msgid "Failed hosts/hostgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:169
+#: ipalib/plugins/baseldap.py:174
 msgid "Failed users/groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:172
+#: ipalib/plugins/baseldap.py:177
 msgid "Failed service/service groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:175
+#: ipalib/plugins/baseldap.py:180
 msgid "Failed to remove"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:179
+#: ipalib/plugins/baseldap.py:184
 msgid "Failed RunAs"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:182
+#: ipalib/plugins/baseldap.py:187
 msgid "Failed RunAsGroup"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:200
+#: ipalib/plugins/baseldap.py:205
 msgid "Invalid format. Should be name=value"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:319
+#: ipalib/plugins/baseldap.py:324
 msgid "External host"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:491
+#: ipalib/plugins/baseldap.py:496
 msgid "An IPA master host cannot be deleted or disabled"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:522
+#: ipalib/plugins/baseldap.py:527
 msgid "entry"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:523
+#: ipalib/plugins/baseldap.py:528
 msgid "entries"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:556 ipalib/plugins/baseldap.py:557
+#: ipalib/plugins/baseldap.py:561 ipalib/plugins/baseldap.py:562
 msgid "Entry"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:560
+#: ipalib/plugins/baseldap.py:565
 #, python-format
 msgid "container entry (%(container)s) not found"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:561
+#: ipalib/plugins/baseldap.py:566
 #, python-format
 msgid "%(parent)s: %(oname)s not found"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:562
+#: ipalib/plugins/baseldap.py:567
 #, python-format
 msgid "%(pkey)s: %(oname)s not found"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:563
+#: ipalib/plugins/baseldap.py:568
 #, python-format
 msgid "%(oname)s with name \"%(pkey)s\" already exists"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:844 ipalib/plugins/baseldap.py:852
-#: ipalib/plugins/baseldap.py:857
+#: ipalib/plugins/baseldap.py:849 ipalib/plugins/baseldap.py:857
+#: ipalib/plugins/baseldap.py:862
 #, python-format
 msgid "attribute \"%(attribute)s\" not allowed"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:919
+#: ipalib/plugins/baseldap.py:924
 msgid ""
 "Set an attribute to a name/value pair. Format is attr=value.\n"
 "For multi-valued attributes, the command replaces the values already present."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:925
+#: ipalib/plugins/baseldap.py:930
 msgid ""
 "Add an attribute/value pair. Format is attr=value. The attribute\n"
 "must be part of the schema."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:931
+#: ipalib/plugins/baseldap.py:936
 msgid ""
 "Delete an attribute/value pair. The option will be evaluated\n"
 "last, after all sets and adds."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:965
+#: ipalib/plugins/baseldap.py:970
 msgid "attribute is not configurable"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1068
+#: ipalib/plugins/baseldap.py:1073
 msgid "No such attribute on this entry"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1164
+#: ipalib/plugins/baseldap.py:1170
 msgid "Suppress processing of membership attributes."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1343
+#: ipalib/plugins/baseldap.py:1327
 msgid "Continuous mode: Don't stop on errors."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1364 ipalib/plugins/baseldap.py:1442
+#: ipalib/plugins/baseldap.py:1348 ipalib/plugins/baseldap.py:1426
 msgid "Rights"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1365 ipalib/plugins/baseldap.py:1443
+#: ipalib/plugins/baseldap.py:1349 ipalib/plugins/baseldap.py:1427
 msgid ""
 "Display the access rights of this entry (requires --all). See ipa man page "
 "for details."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1452
+#: ipalib/plugins/baseldap.py:1436
 msgid "Rename"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1453
+#: ipalib/plugins/baseldap.py:1437
 #, python-format
 msgid "Rename the %(ldap_obj_name)s object"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1543
+#: ipalib/plugins/baseldap.py:1527 ipalib/plugins/baseldap.py:2399
 msgid "the entry was deleted while being modified"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1676 ipalib/plugins/baseldap.py:2151
+#: ipalib/plugins/baseldap.py:1664 ipalib/plugins/baseldap.py:2129
 #, python-format
 msgid "%s"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1688 ipalib/plugins/servicedelegation.py:184
-#: ipalib/plugins/servicedelegation.py:267
+#: ipalib/plugins/baseldap.py:1665 ipalib/plugins/servicedelegation.py:189
+#: ipalib/plugins/servicedelegation.py:272
 #, python-format
 msgid "member %s"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1718 ipalib/plugins/baseldap.py:2176
+#: ipalib/plugins/baseldap.py:1707 ipalib/plugins/baseldap.py:2154
 #, python-format
 msgid "%s to add"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1726 ipalib/plugins/baseldap.py:2188
-#: ipalib/plugins/privilege.py:176 ipalib/plugins/privilege.py:231
+#: ipalib/plugins/baseldap.py:1715 ipalib/plugins/baseldap.py:2166
+#: ipalib/plugins/privilege.py:201 ipalib/plugins/privilege.py:232
 #: ipalib/plugins/role.py:213 ipalib/plugins/role.py:236
 msgid "Members that could not be added"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1730 ipalib/plugins/baseldap.py:2192
+#: ipalib/plugins/baseldap.py:1719 ipalib/plugins/baseldap.py:2170
 msgid "Number of members added"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1820 ipalib/plugins/baseldap.py:2277
+#: ipalib/plugins/baseldap.py:1809 ipalib/plugins/baseldap.py:2255
 #, python-format
 msgid "%s to remove"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1827 ipalib/plugins/baseldap.py:2289
+#: ipalib/plugins/baseldap.py:1816 ipalib/plugins/baseldap.py:2267
 msgid "Members that could not be removed"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1831 ipalib/plugins/baseldap.py:2293
+#: ipalib/plugins/baseldap.py:1820 ipalib/plugins/baseldap.py:2271
 msgid "Number of members removed"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1922
+#: ipalib/plugins/baseldap.py:1911
 msgid "Primary key only"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1923
+#: ipalib/plugins/baseldap.py:1912
 #, python-format
 msgid "Results should contain primary key attribute only (\"%s\")"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1931
+#: ipalib/plugins/baseldap.py:1920
 #, python-format
 msgid ""
 "Search for %(searched_object)s with these %(relationship)s %(ldap_object)s."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1932
+#: ipalib/plugins/baseldap.py:1921
 #, python-format
 msgid ""
 "Search for %(searched_object)s without these %(relationship)s "
 "%(ldap_object)s."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1941
+#: ipalib/plugins/baseldap.py:1930
 msgid "Time Limit"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1942
-msgid "Time limit of search in seconds"
+#: ipalib/plugins/baseldap.py:1931
+msgid "Time limit of search in seconds (0 is unlimited)"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1948 ipalib/plugins/cert.py:786
-#: ipalib/plugins/hbactest.py:289
+#: ipalib/plugins/baseldap.py:1937 ipalib/plugins/cert.py:791
+#: ipalib/plugins/hbactest.py:292
 msgid "Size Limit"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1949
-msgid "Maximum number of entries returned"
+#: ipalib/plugins/baseldap.py:1938
+msgid "Maximum number of entries returned (0 is unlimited)"
+msgstr ""
+
+#: ipalib/plugins/baseldap.py:2433
+msgid "added attribute value to entry %(value)"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:44
+#: ipalib/plugins/baseldap.py:2442
+#, python-format
+msgid "'%s' already contains one or more values"
+msgstr ""
+
+#: ipalib/plugins/baseldap.py:2450
+msgid "removed attribute values from entry %(value)"
+msgstr ""
+
+#: ipalib/plugins/baseldap.py:2459
+msgid "one or more values to remove"
+msgstr ""
+
+#: ipalib/plugins/baseuser.py:48
 msgid ""
 "\n"
 "Baseuser\n"
@@ -2199,245 +2254,245 @@ msgid ""
 "This contains common definitions for user/stageuser\n"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:56
+#: ipalib/plugins/baseuser.py:60
 msgid "Kerberos keys available"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:59 ipalib/plugins/host.py:217
+#: ipalib/plugins/baseuser.py:63 ipalib/plugins/host.py:224
 msgid "SSH public key fingerprint"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:65 ipalib/plugins/radiusproxy.py:114
+#: ipalib/plugins/baseuser.py:69 ipalib/plugins/radiusproxy.py:114
 msgid "Server"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:68
+#: ipalib/plugins/baseuser.py:72
 msgid "Failed logins"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:71
+#: ipalib/plugins/baseuser.py:75
 msgid "Last successful authentication"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:74
+#: ipalib/plugins/baseuser.py:78
 msgid "Last failed authentication"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:77
+#: ipalib/plugins/baseuser.py:81
 msgid "Time now"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:98
+#: ipalib/plugins/baseuser.py:102
 msgid "must be TRUE or FALSE"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:209 ipalib/plugins/internal.py:571
-#: ipalib/plugins/internal.py:637 ipalib/plugins/pwpolicy.py:524
-#: ipalib/plugins/user.py:126
+#: ipalib/plugins/baseuser.py:214 ipalib/plugins/internal.py:590
+#: ipalib/plugins/internal.py:656 ipalib/plugins/pwpolicy.py:529
+#: ipalib/plugins/user.py:134
 msgid "User"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:217 ipalib/plugins/idviews.py:690
+#: ipalib/plugins/baseuser.py:222 ipalib/plugins/idviews.py:838
 msgid "User login"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:224
+#: ipalib/plugins/baseuser.py:229
 msgid "First name"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:228
+#: ipalib/plugins/baseuser.py:233
 msgid "Last name"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:231
+#: ipalib/plugins/baseuser.py:236
 msgid "Full name"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:236
+#: ipalib/plugins/baseuser.py:241
 msgid "Display name"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:241
+#: ipalib/plugins/baseuser.py:246
 msgid "Initials"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:247 ipalib/plugins/idviews.py:709
+#: ipalib/plugins/baseuser.py:252 ipalib/plugins/idviews.py:857
 msgid "Home directory"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:250 ipalib/plugins/idviews.py:700
+#: ipalib/plugins/baseuser.py:255 ipalib/plugins/idviews.py:848
 msgid "GECOS"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:256 ipalib/plugins/idviews.py:713
+#: ipalib/plugins/baseuser.py:261 ipalib/plugins/idviews.py:861
 msgid "Login shell"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:260
+#: ipalib/plugins/baseuser.py:265
 msgid "Kerberos principal"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:268
+#: ipalib/plugins/baseuser.py:273
 msgid "Kerberos principal expiration"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:272
+#: ipalib/plugins/baseuser.py:277
 msgid "Email address"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:277
+#: ipalib/plugins/baseuser.py:282
 msgid "Prompt to set the user password"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:283
+#: ipalib/plugins/baseuser.py:288
 msgid "Generate a random user password"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:288 ipalib/plugins/host.py:493
+#: ipalib/plugins/baseuser.py:293 ipalib/plugins/host.py:500
 msgid "Random password"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:293 ipalib/plugins/idviews.py:695
+#: ipalib/plugins/baseuser.py:298 ipalib/plugins/idviews.py:843
 msgid "UID"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:294
+#: ipalib/plugins/baseuser.py:299
 msgid "User ID Number (system will assign one if not provided)"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:298 ipalib/plugins/group.py:247
-#: ipalib/plugins/idviews.py:703 ipalib/plugins/idviews.py:775
+#: ipalib/plugins/baseuser.py:303 ipalib/plugins/group.py:254
+#: ipalib/plugins/idviews.py:851 ipalib/plugins/idviews.py:930
 msgid "GID"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:299 ipalib/plugins/idviews.py:704
-#: ipalib/plugins/idviews.py:776
+#: ipalib/plugins/baseuser.py:304 ipalib/plugins/idviews.py:852
+#: ipalib/plugins/idviews.py:931
 msgid "Group ID Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:304
+#: ipalib/plugins/baseuser.py:309
 msgid "Street address"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:308
+#: ipalib/plugins/baseuser.py:313
 msgid "City"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:312
+#: ipalib/plugins/baseuser.py:317
 msgid "State/Province"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:315
+#: ipalib/plugins/baseuser.py:320
 msgid "ZIP"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:319
+#: ipalib/plugins/baseuser.py:324
 msgid "Telephone Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:322
+#: ipalib/plugins/baseuser.py:327
 msgid "Mobile Telephone Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:325
+#: ipalib/plugins/baseuser.py:330
 msgid "Pager Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:329
+#: ipalib/plugins/baseuser.py:334
 msgid "Fax Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:333
+#: ipalib/plugins/baseuser.py:338
 msgid "Org. Unit"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:336
+#: ipalib/plugins/baseuser.py:341
 msgid "Job Title"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:339 ipalib/plugins/otptoken.py:178
+#: ipalib/plugins/baseuser.py:345 ipalib/plugins/otptoken.py:182
 msgid "Manager"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:342
+#: ipalib/plugins/baseuser.py:348
 msgid "Car License"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:346 ipalib/plugins/host.py:516
-#: ipalib/plugins/idviews.py:720
+#: ipalib/plugins/baseuser.py:352 ipalib/plugins/host.py:523
+#: ipalib/plugins/idviews.py:868
 msgid "SSH public key"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:353
+#: ipalib/plugins/baseuser.py:359
 msgid "User authentication types"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:354
+#: ipalib/plugins/baseuser.py:360
 msgid "Types of supported user authentication"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:360 ipalib/plugins/host.py:523
+#: ipalib/plugins/baseuser.py:366 ipalib/plugins/host.py:530
 msgid "Class"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:361
+#: ipalib/plugins/baseuser.py:367
 msgid ""
 "User category (semantics placed on this attribute are for local "
 "interpretation)"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:366
+#: ipalib/plugins/baseuser.py:372
 msgid "RADIUS proxy configuration"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:370
+#: ipalib/plugins/baseuser.py:376
 msgid "RADIUS proxy username"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:373
+#: ipalib/plugins/baseuser.py:379
 msgid "Department Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:376
+#: ipalib/plugins/baseuser.py:382
 msgid "Employee Number"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:379
+#: ipalib/plugins/baseuser.py:385
 msgid "Employee Type"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:382
+#: ipalib/plugins/baseuser.py:388
 msgid "Preferred Language"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:389 ipalib/plugins/cert.py:258
-#: ipalib/plugins/cert.py:566 ipalib/plugins/host.py:498
-#: ipalib/plugins/internal.py:354 ipalib/plugins/service.py:453
+#: ipalib/plugins/baseuser.py:395 ipalib/plugins/cert.py:281
+#: ipalib/plugins/cert.py:571 ipalib/plugins/host.py:505
+#: ipalib/plugins/internal.py:371 ipalib/plugins/service.py:483
 msgid "Certificate"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:390 ipalib/plugins/host.py:499
-#: ipalib/plugins/service.py:454
+#: ipalib/plugins/baseuser.py:396 ipalib/plugins/host.py:506
+#: ipalib/plugins/service.py:484
 msgid "Base-64 encoded server certificate"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:409 ipalib/plugins/baseuser.py:413
+#: ipalib/plugins/baseuser.py:415 ipalib/plugins/baseuser.py:419
 #, python-format
 msgid "invalid e-mail format: %(email)s"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:439
+#: ipalib/plugins/baseuser.py:446
 #, python-format
 msgid "manager %(manager)s not found"
 msgstr ""
 
-#: ipalib/plugins/baseuser.py:491 ipalib/plugins/stageuser.py:300
-#: ipalib/plugins/stageuser.py:526 ipalib/plugins/user.py:442
+#: ipalib/plugins/baseuser.py:527 ipalib/plugins/stageuser.py:314
+#: ipalib/plugins/stageuser.py:504 ipalib/plugins/user.py:458
 #, python-format
 msgid "can be at most %(len)d characters"
 msgstr ""
 
-#: ipalib/plugins/batch.py:66
+#: ipalib/plugins/batch.py:71
 msgid "Nested Methods to execute"
 msgstr ""
 
@@ -2477,296 +2532,301 @@ msgid ""
 "    ipa caacl-del test\n"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:135 ipalib/plugins/caacl.py:212
+#: ipalib/plugins/caacl.py:136 ipalib/plugins/caacl.py:213
+#: ipalib/plugins/caacl.py:313
 msgid "CA ACL"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:136 ipalib/plugins/caacl.py:211
+#: ipalib/plugins/caacl.py:137 ipalib/plugins/caacl.py:212
 msgid "CA ACLs"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:217
+#: ipalib/plugins/caacl.py:218
 msgid "ACL name"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:225 ipalib/plugins/hbacrule.py:236
-#: ipalib/plugins/internal.py:785 ipalib/plugins/selinuxusermap.py:230
-#: ipalib/plugins/sudorule.py:226
+#: ipalib/plugins/caacl.py:226 ipalib/plugins/hbacrule.py:236
+#: ipalib/plugins/internal.py:805 ipalib/plugins/selinuxusermap.py:230
+#: ipalib/plugins/sudorule.py:230
 msgid "Enabled"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:237
+#: ipalib/plugins/caacl.py:238
 msgid "Profile category"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:238
+#: ipalib/plugins/caacl.py:239
 msgid "Profile category the ACL applies to"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:243 ipalib/plugins/hbacrule.py:210
-#: ipalib/plugins/netgroup.py:206 ipalib/plugins/selinuxusermap.py:215
-#: ipalib/plugins/sudorule.py:231
+#: ipalib/plugins/caacl.py:244 ipalib/plugins/hbacrule.py:210
+#: ipalib/plugins/netgroup.py:214 ipalib/plugins/selinuxusermap.py:215
+#: ipalib/plugins/sudorule.py:235
 msgid "User category"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:244
+#: ipalib/plugins/caacl.py:245
 msgid "User category the ACL applies to"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:249 ipalib/plugins/hbacrule.py:216
-#: ipalib/plugins/netgroup.py:212 ipalib/plugins/selinuxusermap.py:221
-#: ipalib/plugins/sudorule.py:237
+#: ipalib/plugins/caacl.py:250 ipalib/plugins/hbacrule.py:216
+#: ipalib/plugins/netgroup.py:220 ipalib/plugins/selinuxusermap.py:221
+#: ipalib/plugins/sudorule.py:241
 msgid "Host category"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:250
+#: ipalib/plugins/caacl.py:251
 msgid "Host category the ACL applies to"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:255 ipalib/plugins/hbacrule.py:223
+#: ipalib/plugins/caacl.py:256 ipalib/plugins/hbacrule.py:223
 msgid "Service category"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:256
+#: ipalib/plugins/caacl.py:257
 msgid "Service category the ACL applies to"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:265
+#: ipalib/plugins/caacl.py:266 ipalib/plugins/internal.py:359
 msgid "Profiles"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:273 ipalib/plugins/group.py:227
-#: ipalib/plugins/hbacrule.py:244 ipalib/plugins/internal.py:572
-#: ipalib/plugins/selinuxusermap.py:238 ipalib/plugins/sudorule.py:271
+#: ipalib/plugins/caacl.py:274 ipalib/plugins/group.py:234
+#: ipalib/plugins/hbacrule.py:244 ipalib/plugins/internal.py:591
+#: ipalib/plugins/selinuxusermap.py:238 ipalib/plugins/sudorule.py:275
 msgid "User Groups"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:281 ipalib/plugins/hbacrule.py:252
-#: ipalib/plugins/hostgroup.py:141 ipalib/plugins/internal.py:566
-#: ipalib/plugins/selinuxusermap.py:246 ipalib/plugins/sudorule.py:284
+#: ipalib/plugins/caacl.py:282 ipalib/plugins/hbacrule.py:252
+#: ipalib/plugins/hostgroup.py:147 ipalib/plugins/internal.py:585
+#: ipalib/plugins/selinuxusermap.py:246 ipalib/plugins/sudorule.py:288
 msgid "Host Groups"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:285 ipalib/plugins/hbacrule.py:258
-#: ipalib/plugins/internal.py:485 ipalib/plugins/service.py:440
+#: ipalib/plugins/caacl.py:286 ipalib/plugins/hbacrule.py:258
+#: ipalib/plugins/internal.py:504 ipalib/plugins/service.py:470
 msgid "Services"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:293
+#: ipalib/plugins/caacl.py:294
 msgid "Create a new CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:295
+#: ipalib/plugins/caacl.py:296
 #, python-format
 msgid "Added CA ACL \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/caacl.py:305
+#: ipalib/plugins/caacl.py:306
 msgid "Delete a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:307
+#: ipalib/plugins/caacl.py:308
 #, python-format
 msgid "Deleted CA ACL \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/caacl.py:312
+#: ipalib/plugins/caacl.py:315
+msgid "default CA ACL can be only disabled"
+msgstr ""
+
+#: ipalib/plugins/caacl.py:321
 msgid "Modify a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:314
+#: ipalib/plugins/caacl.py:323
 #, python-format
 msgid "Modified CA ACL \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/caacl.py:332
+#: ipalib/plugins/caacl.py:341
 msgid ""
 "profile category cannot be set to 'all' while there are allowed profiles"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:336 ipalib/plugins/hbacrule.py:316
-#: ipalib/plugins/netgroup.py:279
+#: ipalib/plugins/caacl.py:345 ipalib/plugins/hbacrule.py:316
+#: ipalib/plugins/netgroup.py:287
 msgid "user category cannot be set to 'all' while there are allowed users"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:340 ipalib/plugins/hbacrule.py:318
-#: ipalib/plugins/netgroup.py:281
+#: ipalib/plugins/caacl.py:349 ipalib/plugins/hbacrule.py:318
+#: ipalib/plugins/netgroup.py:289
 msgid "host category cannot be set to 'all' while there are allowed hosts"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:344 ipalib/plugins/hbacrule.py:320
+#: ipalib/plugins/caacl.py:353 ipalib/plugins/hbacrule.py:320
 msgid ""
 "service category cannot be set to 'all' while there are allowed services"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:351
+#: ipalib/plugins/caacl.py:360
 msgid "Search for CA ACLs."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:354
+#: ipalib/plugins/caacl.py:363
 #, python-format
 msgid "%(count)d CA ACL matched"
 msgid_plural "%(count)d CA ACLs matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/caacl.py:360
+#: ipalib/plugins/caacl.py:369
 msgid "Display the properties of a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:365
+#: ipalib/plugins/caacl.py:374
 msgid "Enable a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:367
+#: ipalib/plugins/caacl.py:376
 #, python-format
 msgid "Enabled CA ACL \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/caacl.py:394
+#: ipalib/plugins/caacl.py:403
 msgid "Disable a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:396
+#: ipalib/plugins/caacl.py:405
 #, python-format
 msgid "Disabled CA ACL \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/caacl.py:423
+#: ipalib/plugins/caacl.py:432
 msgid "Add users and groups to a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:427
+#: ipalib/plugins/caacl.py:436
 #, python-format
 msgid "%i user or group added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:428
+#: ipalib/plugins/caacl.py:437
 #, python-format
 msgid "%i users or groups added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:439 ipalib/plugins/hbacrule.py:499
-#: ipalib/plugins/selinuxusermap.py:509 ipalib/plugins/sudorule.py:590
+#: ipalib/plugins/caacl.py:448 ipalib/plugins/hbacrule.py:499
+#: ipalib/plugins/selinuxusermap.py:509 ipalib/plugins/sudorule.py:594
 msgid "users cannot be added when user category='all'"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:445
+#: ipalib/plugins/caacl.py:454
 msgid "Remove users and groups from a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:449
+#: ipalib/plugins/caacl.py:458
 #, python-format
 msgid "%i user or group removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:450
+#: ipalib/plugins/caacl.py:459
 #, python-format
 msgid "%i users or groups removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:455
+#: ipalib/plugins/caacl.py:464
 msgid "Add target hosts and hostgroups to a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:459
+#: ipalib/plugins/caacl.py:468
 #, python-format
 msgid "%i host or hostgroup added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:460
+#: ipalib/plugins/caacl.py:469
 #, python-format
 msgid "%i hosts or hostgroups added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:471 ipalib/plugins/hbacrule.py:530
-#: ipalib/plugins/selinuxusermap.py:542 ipalib/plugins/sudorule.py:644
+#: ipalib/plugins/caacl.py:480 ipalib/plugins/hbacrule.py:530
+#: ipalib/plugins/selinuxusermap.py:542 ipalib/plugins/sudorule.py:648
 msgid "hosts cannot be added when host category='all'"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:477
+#: ipalib/plugins/caacl.py:486
 msgid "Remove target hosts and hostgroups from a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:481
+#: ipalib/plugins/caacl.py:490
 #, python-format
 msgid "%i host or hostgroup removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:482
+#: ipalib/plugins/caacl.py:491
 #, python-format
 msgid "%i hosts or hostgroups removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:487
+#: ipalib/plugins/caacl.py:496
 msgid "Add services to a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:490
+#: ipalib/plugins/caacl.py:499
 #, python-format
 msgid "%i service added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:490
+#: ipalib/plugins/caacl.py:499
 #, python-format
 msgid "%i services added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:501 ipalib/plugins/hbacrule.py:585
+#: ipalib/plugins/caacl.py:510 ipalib/plugins/hbacrule.py:585
 msgid "services cannot be added when service category='all'"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:507
+#: ipalib/plugins/caacl.py:516
 msgid "Remove services from a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:510
+#: ipalib/plugins/caacl.py:519
 #, python-format
 msgid "%i service removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:510
+#: ipalib/plugins/caacl.py:519
 #, python-format
 msgid "%i services removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:515
+#: ipalib/plugins/caacl.py:524
 msgid "Failed profiles"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:526
+#: ipalib/plugins/caacl.py:535
 msgid "Add profiles to a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:531
+#: ipalib/plugins/caacl.py:540
 #, python-format
 msgid "%i profile added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:531
+#: ipalib/plugins/caacl.py:540
 #, python-format
 msgid "%i profiles added."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:542
+#: ipalib/plugins/caacl.py:551
 msgid "profiles cannot be added when profile category='all'"
 msgstr ""
 
-#: ipalib/plugins/caacl.py:548
+#: ipalib/plugins/caacl.py:557
 msgid "Remove profiles from a CA ACL."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:553
+#: ipalib/plugins/caacl.py:562
 #, python-format
 msgid "%i profile removed."
 msgstr ""
 
-#: ipalib/plugins/caacl.py:553
+#: ipalib/plugins/caacl.py:562
 #, python-format
 msgid "%i profiles removed."
 msgstr ""
 
-#: ipalib/plugins/cert.py:47
+#: ipalib/plugins/cert.py:54
 msgid ""
 "\n"
 "IPA certificate operations\n"
@@ -2850,124 +2910,119 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/cert.py:157 ipalib/plugins/cert.py:366
+#: ipalib/plugins/cert.py:164 ipalib/plugins/cert.py:375
 #, python-format
 msgid "Failure decoding Certificate Signing Request: %s"
 msgstr ""
 
-#: ipalib/plugins/cert.py:221 ipalib/plugins/certprofile.py:65
+#: ipalib/plugins/cert.py:228 ipalib/plugins/certprofile.py:89
 msgid "CA is not configured"
 msgstr ""
 
-#: ipalib/plugins/cert.py:225
+#: ipalib/plugins/cert.py:236
+#, python-format
+msgid ""
+"Principal '%(principal)s' is not permitted to use CA '%(ca)s' with profile "
+"'%(profile_id)s' for certificate issuance."
+msgstr ""
+
+#: ipalib/plugins/cert.py:248
 msgid "Submit a certificate signing request."
 msgstr ""
 
-#: ipalib/plugins/cert.py:229
+#: ipalib/plugins/cert.py:252
 msgid "CSR"
 msgstr ""
 
-#: ipalib/plugins/cert.py:238 ipalib/plugins/service.py:446
+#: ipalib/plugins/cert.py:261 ipalib/plugins/service.py:476
 msgid "Principal"
 msgstr ""
 
-#: ipalib/plugins/cert.py:239
+#: ipalib/plugins/cert.py:262
 msgid "Principal for this certificate (e.g. HTTP/test.example.com)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:246
+#: ipalib/plugins/cert.py:269
 msgid "automatically add the principal if it doesn't exist"
 msgstr ""
 
-#: ipalib/plugins/cert.py:251 ipalib/plugins/certprofile.py:102
+#: ipalib/plugins/cert.py:274 ipalib/plugins/certprofile.py:125
 msgid "Profile ID"
 msgstr ""
 
-#: ipalib/plugins/cert.py:252
+#: ipalib/plugins/cert.py:275
 msgid "Certificate Profile to use"
 msgstr ""
 
-#: ipalib/plugins/cert.py:261 ipalib/plugins/cert.py:569
-#: ipalib/plugins/cert.py:726 ipalib/plugins/cert.py:727
-#: ipalib/plugins/host.py:187 ipalib/plugins/internal.py:367
-#: ipalib/plugins/service.py:108
+#: ipalib/plugins/cert.py:284 ipalib/plugins/cert.py:574
+#: ipalib/plugins/cert.py:731 ipalib/plugins/cert.py:732
+#: ipalib/plugins/host.py:194 ipalib/plugins/internal.py:384
+#: ipalib/plugins/service.py:113
 msgid "Subject"
 msgstr ""
 
-#: ipalib/plugins/cert.py:264 ipalib/plugins/cert.py:572
-#: ipalib/plugins/host.py:196 ipalib/plugins/service.py:117
+#: ipalib/plugins/cert.py:287 ipalib/plugins/cert.py:577
+#: ipalib/plugins/host.py:203 ipalib/plugins/service.py:122
 msgid "Issuer"
 msgstr ""
 
-#: ipalib/plugins/cert.py:267 ipalib/plugins/cert.py:575
-#: ipalib/plugins/host.py:199 ipalib/plugins/service.py:120
+#: ipalib/plugins/cert.py:290 ipalib/plugins/cert.py:580
+#: ipalib/plugins/host.py:206 ipalib/plugins/service.py:125
 msgid "Not Before"
 msgstr ""
 
-#: ipalib/plugins/cert.py:270 ipalib/plugins/cert.py:578
-#: ipalib/plugins/host.py:202 ipalib/plugins/service.py:123
+#: ipalib/plugins/cert.py:293 ipalib/plugins/cert.py:583
+#: ipalib/plugins/host.py:209 ipalib/plugins/service.py:128
 msgid "Not After"
 msgstr ""
 
-#: ipalib/plugins/cert.py:273 ipalib/plugins/cert.py:581
-#: ipalib/plugins/host.py:205 ipalib/plugins/service.py:126
+#: ipalib/plugins/cert.py:296 ipalib/plugins/cert.py:586
+#: ipalib/plugins/host.py:212 ipalib/plugins/service.py:131
 msgid "Fingerprint (MD5)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:276 ipalib/plugins/cert.py:584
-#: ipalib/plugins/host.py:208 ipalib/plugins/service.py:129
+#: ipalib/plugins/cert.py:299 ipalib/plugins/cert.py:589
+#: ipalib/plugins/host.py:215 ipalib/plugins/service.py:134
 msgid "Fingerprint (SHA1)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:279 ipalib/plugins/cert.py:553
-#: ipalib/plugins/cert.py:800
+#: ipalib/plugins/cert.py:302 ipalib/plugins/cert.py:558
+#: ipalib/plugins/cert.py:805
 msgid "Serial number"
 msgstr ""
 
-#: ipalib/plugins/cert.py:282 ipalib/plugins/cert.py:590
-#: ipalib/plugins/cert.py:797
+#: ipalib/plugins/cert.py:305 ipalib/plugins/cert.py:595
+#: ipalib/plugins/cert.py:802
 msgid "Serial number (hex)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:289 ipalib/plugins/misc.py:61
+#: ipalib/plugins/cert.py:312 ipalib/plugins/misc.py:61
 msgid "Dictionary mapping variable name to value"
 msgstr ""
 
-#: ipalib/plugins/cert.py:336
-#, python-format
-msgid ""
-"Principal '%(principal)s' is not permitted to use CA '%(ca)s' with profile "
-"'%(profile_id)s' for certificate issuance."
-msgstr ""
-
-#: ipalib/plugins/cert.py:391
+#: ipalib/plugins/cert.py:398
 msgid "The principal for this request doesn't exist."
 msgstr ""
 
-#: ipalib/plugins/cert.py:399
+#: ipalib/plugins/cert.py:406
 msgid "No Common Name was found in subject of request."
 msgstr ""
 
-#: ipalib/plugins/cert.py:404
+#: ipalib/plugins/cert.py:411
 #, python-format
 msgid ""
 "hostname in subject of request '%(cn)s' does not match principal hostname "
 "'%(hostname)s'"
 msgstr ""
 
-#: ipalib/plugins/cert.py:413
-msgid "DN commonName does not match any of user's email addresses"
+#: ipalib/plugins/cert.py:419
+msgid "DN commonName does not match user's login"
 msgstr ""
 
-#: ipalib/plugins/cert.py:423
+#: ipalib/plugins/cert.py:428
 msgid "DN emailAddress does not match any of user's email addresses"
 msgstr ""
 
-#: ipalib/plugins/cert.py:430
-#, python-format
-msgid "extension %s is forbidden"
-msgstr ""
-
 #: ipalib/plugins/cert.py:434
 #, python-format
 msgid ""
@@ -2975,175 +3030,175 @@ msgid ""
 "'%s'."
 msgstr ""
 
-#: ipalib/plugins/cert.py:452
+#: ipalib/plugins/cert.py:454
 #, python-format
 msgid "subject alt name type %s is forbidden for user principals"
 msgstr ""
 
-#: ipalib/plugins/cert.py:459
+#: ipalib/plugins/cert.py:461
 #, python-format
 msgid ""
 "The service principal for subject alt name %s in certificate request does "
 "not exist"
 msgstr ""
 
-#: ipalib/plugins/cert.py:466
+#: ipalib/plugins/cert.py:468
 #, python-format
 msgid ""
 "Insufficient privilege to create a certificate with subject alt name '%s'."
 msgstr ""
 
-#: ipalib/plugins/cert.py:472
+#: ipalib/plugins/cert.py:477
 #, python-format
 msgid "Principal '%s' in subject alt name does not match requested principal"
 msgstr ""
 
-#: ipalib/plugins/cert.py:480
+#: ipalib/plugins/cert.py:485
 msgid "RFC822Name does not match any of user's email addresses"
 msgstr ""
 
-#: ipalib/plugins/cert.py:486
+#: ipalib/plugins/cert.py:491
 #, python-format
 msgid "subject alt name type %s is forbidden for non-user principals"
 msgstr ""
 
-#: ipalib/plugins/cert.py:491
+#: ipalib/plugins/cert.py:496
 #, python-format
 msgid "Subject alt name type %s is forbidden"
 msgstr ""
 
-#: ipalib/plugins/cert.py:526
+#: ipalib/plugins/cert.py:531
 msgid "Check the status of a certificate signing request."
 msgstr ""
 
-#: ipalib/plugins/cert.py:530
+#: ipalib/plugins/cert.py:535
 msgid "Request id"
 msgstr ""
 
-#: ipalib/plugins/cert.py:536
+#: ipalib/plugins/cert.py:541
 msgid "Request status"
 msgstr ""
 
-#: ipalib/plugins/cert.py:554
+#: ipalib/plugins/cert.py:559
 msgid "Serial number in decimal or if prefixed with 0x in hexadecimal"
 msgstr ""
 
-#: ipalib/plugins/cert.py:560
+#: ipalib/plugins/cert.py:565
 msgid "Retrieve an existing certificate."
 msgstr ""
 
-#: ipalib/plugins/cert.py:587 ipalib/plugins/host.py:211
-#: ipalib/plugins/internal.py:364 ipalib/plugins/internal.py:394
-#: ipalib/plugins/service.py:132
+#: ipalib/plugins/cert.py:592 ipalib/plugins/host.py:218
+#: ipalib/plugins/internal.py:381 ipalib/plugins/internal.py:413
+#: ipalib/plugins/service.py:137
 msgid "Revocation reason"
 msgstr ""
 
-#: ipalib/plugins/cert.py:596
+#: ipalib/plugins/cert.py:601
 msgid "Output filename"
 msgstr ""
 
-#: ipalib/plugins/cert.py:597
+#: ipalib/plugins/cert.py:602
 msgid "File to store the certificate in."
 msgstr ""
 
-#: ipalib/plugins/cert.py:649
+#: ipalib/plugins/cert.py:654
 msgid "Revoke a certificate."
 msgstr ""
 
-#: ipalib/plugins/cert.py:655
+#: ipalib/plugins/cert.py:660
 msgid "Revoked"
 msgstr ""
 
-#: ipalib/plugins/cert.py:663 ipalib/plugins/cert.py:731
+#: ipalib/plugins/cert.py:668 ipalib/plugins/cert.py:736
 msgid "Reason"
 msgstr ""
 
-#: ipalib/plugins/cert.py:664 ipalib/plugins/cert.py:732
+#: ipalib/plugins/cert.py:669 ipalib/plugins/cert.py:737
 msgid "Reason for revoking the certificate (0-10)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:687
+#: ipalib/plugins/cert.py:692
 msgid "7 is not a valid revocation reason"
 msgstr ""
 
-#: ipalib/plugins/cert.py:697
+#: ipalib/plugins/cert.py:702
 msgid "Take a revoked certificate off hold."
 msgstr ""
 
-#: ipalib/plugins/cert.py:703
+#: ipalib/plugins/cert.py:708
 msgid "Unrevoked"
 msgstr ""
 
-#: ipalib/plugins/cert.py:706 ipalib/plugins/internal.py:275
+#: ipalib/plugins/cert.py:711 ipalib/plugins/internal.py:278
 msgid "Error"
 msgstr ""
 
-#: ipalib/plugins/cert.py:722
+#: ipalib/plugins/cert.py:727
 msgid "Search for existing certificates."
 msgstr ""
 
-#: ipalib/plugins/cert.py:738
+#: ipalib/plugins/cert.py:743
 msgid "minimum serial number"
 msgstr ""
 
-#: ipalib/plugins/cert.py:744
+#: ipalib/plugins/cert.py:749
 msgid "maximum serial number"
 msgstr ""
 
-#: ipalib/plugins/cert.py:750
+#: ipalib/plugins/cert.py:755
 msgid "match the common name exactly"
 msgstr ""
 
-#: ipalib/plugins/cert.py:754
+#: ipalib/plugins/cert.py:759
 msgid "Valid not after from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:758
+#: ipalib/plugins/cert.py:763
 msgid "Valid not after to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:762
+#: ipalib/plugins/cert.py:767
 msgid "Valid not before from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:766
+#: ipalib/plugins/cert.py:771
 msgid "Valid not before to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:770
+#: ipalib/plugins/cert.py:775
 msgid "Issued on from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:774
+#: ipalib/plugins/cert.py:779
 msgid "Issued on to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:778
+#: ipalib/plugins/cert.py:783
 msgid "Revoked on from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:782
+#: ipalib/plugins/cert.py:787
 msgid "Revoked on to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:787
+#: ipalib/plugins/cert.py:792
 msgid "Maximum number of certs returned"
 msgstr ""
 
-#: ipalib/plugins/cert.py:803 ipalib/plugins/internal.py:402
-#: ipalib/plugins/internal.py:520 ipalib/plugins/internal.py:647
-#: ipalib/plugins/internal.py:786
+#: ipalib/plugins/cert.py:808 ipalib/plugins/internal.py:421
+#: ipalib/plugins/internal.py:539 ipalib/plugins/internal.py:666
+#: ipalib/plugins/internal.py:806
 msgid "Status"
 msgstr ""
 
-#: ipalib/plugins/cert.py:808
+#: ipalib/plugins/cert.py:813
 #, python-format
 msgid "%(count)d certificate matched"
 msgid_plural "%(count)d certificates matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/certprofile.py:20
+#: ipalib/plugins/certprofile.py:24
 msgid ""
 "\n"
 "Manage Certificate Profiles\n"
@@ -3168,7 +3223,7 @@ msgid ""
 "\n"
 "  Import a profile that will not store issued certificates:\n"
 "    ipa certprofile-import ShortLivedUserCert \\\n"
-"      --file UserCert.profile --summary \"User Certificates\" \\\n"
+"      --file UserCert.profile --desc \"User Certificates\" \\\n"
 "      --store=false\n"
 "\n"
 "  Delete a certificate profile:\n"
@@ -3177,98 +3232,140 @@ msgid ""
 "  Show information about a profile:\n"
 "    ipa certprofile-show ShortLivedUserCert\n"
 "\n"
+"  Save profile configuration to a file:\n"
+"    ipa certprofile-show caIPAserviceCert --out caIPAserviceCert.cfg\n"
+"\n"
 "  Search for profiles that do not store certificates:\n"
 "    ipa certprofile-find --store=false\n"
 "\n"
+"PROFILE CONFIGURATION FORMAT:\n"
+"\n"
+"The profile configuration format is the raw property-list format\n"
+"used by Dogtag Certificate System.  The XML format is not supported.\n"
+"\n"
+"The following restrictions apply to profiles managed by FreeIPA:\n"
+"\n"
+"- When importing a profile the \"profileId\" field, if present, must\n"
+"  match the ID given on the command line.\n"
+"\n"
+"- The \"classId\" field must be set to \"caEnrollImpl\"\n"
+"\n"
+"- The \"auth.instance_id\" field must be set to \"raCertAuth\"\n"
+"\n"
+"- The \"certReqInputImpl\" input class and \"certOutputImpl\" output\n"
+"  class must be used.\n"
+"\n"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:74
+#: ipalib/plugins/certprofile.py:98
 msgid "invalid Profile ID"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:85 ipalib/plugins/certprofile.py:96
+#: ipalib/plugins/certprofile.py:109 ipalib/plugins/certprofile.py:119
 msgid "Certificate Profile"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:86 ipalib/plugins/certprofile.py:95
+#: ipalib/plugins/certprofile.py:110 ipalib/plugins/certprofile.py:118
 msgid "Certificate Profiles"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:103
+#: ipalib/plugins/certprofile.py:126
 msgid "Profile ID for referring to this profile"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:108
+#: ipalib/plugins/certprofile.py:131
 msgid "Profile description"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:109
+#: ipalib/plugins/certprofile.py:132
 msgid "Brief description of this profile"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:114
+#: ipalib/plugins/certprofile.py:137
 msgid "Store issued certificates"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:115
+#: ipalib/plugins/certprofile.py:138
 msgid "Whether to store certs issued using this profile"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:164
+#: ipalib/plugins/certprofile.py:187
 msgid "Search for Certificate Profiles."
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:166
+#: ipalib/plugins/certprofile.py:189
 #, python-format
 msgid "%(count)d profile matched"
 msgid_plural "%(count)d profiles matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/certprofile.py:176
+#: ipalib/plugins/certprofile.py:199
 msgid "Display the properties of a Certificate Profile."
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:185
-msgid "Import a Certificate Profile."
+#: ipalib/plugins/certprofile.py:203
+msgid "Profile configuration"
+msgstr ""
+
+#: ipalib/plugins/certprofile.py:209
+msgid "Write profile configuration to file"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:186
+#: ipalib/plugins/certprofile.py:232
 #, python-format
-msgid "Imported profile \"%(value)s\""
+msgid "Profile configuration stored in file '%(file)s'"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:189
-msgid "Filename"
+#: ipalib/plugins/certprofile.py:241
+msgid "Import a Certificate Profile."
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:203
-msgid "Profile ID is not present in profile data"
+#: ipalib/plugins/certprofile.py:242
+#, python-format
+msgid "Imported profile \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:206
+#: ipalib/plugins/certprofile.py:245
+msgid "Filename of a raw profile. The XML format is not supported."
+msgstr ""
+
+#: ipalib/plugins/certprofile.py:263
 #, python-format
 msgid "Profile ID '%(cli_value)s' does not match profile data '%(file_value)s'"
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:232
+#: ipalib/plugins/certprofile.py:288
 msgid "Delete a Certificate Profile."
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:233
+#: ipalib/plugins/certprofile.py:289
 #, python-format
 msgid "Deleted profile \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:248
+#: ipalib/plugins/certprofile.py:296
+#, python-format
+msgid "Predefined profile '%(profile_id)s' cannot be deleted"
+msgstr ""
+
+#: ipalib/plugins/certprofile.py:311
 msgid "Modify Certificate Profile configuration."
 msgstr ""
 
-#: ipalib/plugins/certprofile.py:249
+#: ipalib/plugins/certprofile.py:312
 #, python-format
 msgid "Modified Certificate Profile \"%(value)s\""
 msgstr ""
 
+#: ipalib/plugins/certprofile.py:316
+msgid "File containing profile configuration"
+msgstr ""
+
+#: ipalib/plugins/certprofile.py:327
+msgid "Certificate profiles cannot be renamed"
+msgstr ""
+
 #: ipalib/plugins/config.py:33
 msgid ""
 "\n"
@@ -3319,191 +3416,186 @@ msgid ""
 "s0:c0.c1023$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023'\n"
 msgstr ""
 
-#: ipalib/plugins/config.py:83
-msgid "searchtimelimit must be -1 or > 1."
-msgstr ""
-
-#: ipalib/plugins/config.py:91
+#: ipalib/plugins/config.py:86
 msgid "configuration options"
 msgstr ""
 
-#: ipalib/plugins/config.py:124 ipalib/plugins/config.py:125
+#: ipalib/plugins/config.py:119 ipalib/plugins/config.py:120
 msgid "Configuration"
 msgstr ""
 
-#: ipalib/plugins/config.py:130
+#: ipalib/plugins/config.py:125
 msgid "Maximum username length"
 msgstr ""
 
-#: ipalib/plugins/config.py:135
+#: ipalib/plugins/config.py:130
 msgid "Home directory base"
 msgstr ""
 
-#: ipalib/plugins/config.py:136
+#: ipalib/plugins/config.py:131
 msgid "Default location of home directories"
 msgstr ""
 
-#: ipalib/plugins/config.py:140
+#: ipalib/plugins/config.py:135
 msgid "Default shell"
 msgstr ""
 
-#: ipalib/plugins/config.py:141
+#: ipalib/plugins/config.py:136
 msgid "Default shell for new users"
 msgstr ""
 
-#: ipalib/plugins/config.py:145
+#: ipalib/plugins/config.py:140
 msgid "Default users group"
 msgstr ""
 
-#: ipalib/plugins/config.py:146
+#: ipalib/plugins/config.py:141
 msgid "Default group for new users"
 msgstr ""
 
-#: ipalib/plugins/config.py:150 ipalib/plugins/config.py:151
+#: ipalib/plugins/config.py:145 ipalib/plugins/config.py:146
 msgid "Default e-mail domain"
 msgstr ""
 
-#: ipalib/plugins/config.py:155
+#: ipalib/plugins/config.py:150
 msgid "Search time limit"
 msgstr ""
 
-#: ipalib/plugins/config.py:156
-msgid ""
-"Maximum amount of time (seconds) for a search (> 0, or -1 for unlimited)"
+#: ipalib/plugins/config.py:151
+msgid "Maximum amount of time (seconds) for a search (-1 or 0 is unlimited)"
 msgstr ""
 
-#: ipalib/plugins/config.py:161
+#: ipalib/plugins/config.py:156
 msgid "Search size limit"
 msgstr ""
 
-#: ipalib/plugins/config.py:162
-msgid "Maximum number of records to search (-1 is unlimited)"
+#: ipalib/plugins/config.py:157
+msgid "Maximum number of records to search (-1 or 0 is unlimited)"
 msgstr ""
 
-#: ipalib/plugins/config.py:167
+#: ipalib/plugins/config.py:162
 msgid "User search fields"
 msgstr ""
 
-#: ipalib/plugins/config.py:168
+#: ipalib/plugins/config.py:163
 msgid "A comma-separated list of fields to search in when searching for users"
 msgstr ""
 
-#: ipalib/plugins/config.py:173
+#: ipalib/plugins/config.py:168
 msgid "A comma-separated list of fields to search in when searching for groups"
 msgstr ""
 
-#: ipalib/plugins/config.py:177 ipalib/plugins/config.py:178
+#: ipalib/plugins/config.py:172 ipalib/plugins/config.py:173
 msgid "Enable migration mode"
 msgstr ""
 
-#: ipalib/plugins/config.py:182
+#: ipalib/plugins/config.py:177
 msgid "Certificate Subject base"
 msgstr ""
 
-#: ipalib/plugins/config.py:183
+#: ipalib/plugins/config.py:178
 msgid "Base for certificate subjects (OU=Test,O=Example)"
 msgstr ""
 
-#: ipalib/plugins/config.py:188
+#: ipalib/plugins/config.py:183
 msgid "Default group objectclasses"
 msgstr ""
 
-#: ipalib/plugins/config.py:189
+#: ipalib/plugins/config.py:184
 msgid "Default group objectclasses (comma-separated list)"
 msgstr ""
 
-#: ipalib/plugins/config.py:194
+#: ipalib/plugins/config.py:189
 msgid "Default user objectclasses"
 msgstr ""
 
-#: ipalib/plugins/config.py:195
+#: ipalib/plugins/config.py:190
 msgid "Default user objectclasses (comma-separated list)"
 msgstr ""
 
-#: ipalib/plugins/config.py:200
+#: ipalib/plugins/config.py:195
 msgid "Password Expiration Notification (days)"
 msgstr ""
 
-#: ipalib/plugins/config.py:201
+#: ipalib/plugins/config.py:196
 msgid "Number of days's notice of impending password expiration"
 msgstr ""
 
-#: ipalib/plugins/config.py:206
+#: ipalib/plugins/config.py:201
 msgid "Password plugin features"
 msgstr ""
 
-#: ipalib/plugins/config.py:207
+#: ipalib/plugins/config.py:202
 msgid "Extra hashes to generate in password plug-in"
 msgstr ""
 
-#: ipalib/plugins/config.py:213
+#: ipalib/plugins/config.py:208
 msgid "SELinux user map order"
 msgstr ""
 
-#: ipalib/plugins/config.py:214
+#: ipalib/plugins/config.py:209
 msgid "Order in increasing priority of SELinux users, delimited by $"
 msgstr ""
 
-#: ipalib/plugins/config.py:217
+#: ipalib/plugins/config.py:212
 msgid "Default SELinux user"
 msgstr ""
 
-#: ipalib/plugins/config.py:218
+#: ipalib/plugins/config.py:213
 msgid "Default SELinux user when no match is found in SELinux map rule"
 msgstr ""
 
-#: ipalib/plugins/config.py:222
+#: ipalib/plugins/config.py:217
 msgid "Default PAC types"
 msgstr ""
 
-#: ipalib/plugins/config.py:223
+#: ipalib/plugins/config.py:218
 msgid "Default types of PAC supported for services"
 msgstr ""
 
-#: ipalib/plugins/config.py:229
+#: ipalib/plugins/config.py:224
 msgid "Default user authentication types"
 msgstr ""
 
-#: ipalib/plugins/config.py:230
+#: ipalib/plugins/config.py:225
 msgid "Default types of supported user authentication"
 msgstr ""
 
-#: ipalib/plugins/config.py:243
+#: ipalib/plugins/config.py:238
 msgid "Modify configuration options."
 msgstr ""
 
-#: ipalib/plugins/config.py:252
+#: ipalib/plugins/config.py:247
 msgid "The group doesn't exist"
 msgstr ""
 
-#: ipalib/plugins/config.py:267
+#: ipalib/plugins/config.py:263
 #, python-format
 msgid "attribute \"%s\" not allowed"
 msgstr ""
 
-#: ipalib/plugins/config.py:275
+#: ipalib/plugins/config.py:281
 msgid "May not be empty"
 msgstr ""
 
-#: ipalib/plugins/config.py:293
+#: ipalib/plugins/config.py:300
 #, python-format
 msgid "%(obj)s default attribute %(attr)s would not be allowed!"
 msgstr ""
 
-#: ipalib/plugins/config.py:325
+#: ipalib/plugins/config.py:332
 msgid "A list of SELinux users delimited by $ expected"
 msgstr ""
 
-#: ipalib/plugins/config.py:329
+#: ipalib/plugins/config.py:336
 #, python-format
 msgid "SELinux user '%(user)s' is not valid: %(error)s"
 msgstr ""
 
-#: ipalib/plugins/config.py:341
+#: ipalib/plugins/config.py:348
 msgid "SELinux user map default user not in order list"
 msgstr ""
 
-#: ipalib/plugins/config.py:349
+#: ipalib/plugins/config.py:356
 msgid "Show the current configuration."
 msgstr ""
 
@@ -3554,7 +3646,7 @@ msgid "Delegation"
 msgstr ""
 
 #: ipalib/plugins/delegation.py:81 ipalib/plugins/delegation.py:82
-#: ipalib/plugins/servicedelegation.py:161
+#: ipalib/plugins/servicedelegation.py:166
 msgid "Delegation name"
 msgstr ""
 
@@ -3616,19 +3708,19 @@ msgstr[1] ""
 msgid "Display information about a delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:56
+#: ipalib/plugins/dns.py:62
 msgid ""
 "\n"
 "Domain Name System (DNS)\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:58
+#: ipalib/plugins/dns.py:64
 msgid ""
 "\n"
 "Manage DNS zone and resource records.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:60
+#: ipalib/plugins/dns.py:66
 msgid ""
 "\n"
 "SUPPORTED ZONE TYPES\n"
@@ -3639,13 +3731,13 @@ msgid ""
 " (a set of DNS servers).\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:66
+#: ipalib/plugins/dns.py:72
 msgid ""
 "\n"
 "USING STRUCTURED PER-TYPE OPTIONS\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:68
+#: ipalib/plugins/dns.py:74
 msgid ""
 "\n"
 "There are many structured DNS RR types where DNS data stored in LDAP server\n"
@@ -3655,7 +3747,7 @@ msgid ""
 "minutes, seconds of latitude and longitude, altitude or precision).\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:74
+#: ipalib/plugins/dns.py:80
 msgid ""
 "\n"
 "It may be difficult to manipulate such DNS records without making a mistake\n"
@@ -3670,7 +3762,7 @@ msgid ""
 "--mx-preference and --mx-exchanger.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:82
+#: ipalib/plugins/dns.py:88
 msgid ""
 "\n"
 "When adding a record, either RR specific options or standard option for a "
@@ -3685,28 +3777,28 @@ msgid ""
 "ipa dnsrecord-mod --mx-rec=\"0 mx.example.com.\" --mx-preference=1\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:91
+#: ipalib/plugins/dns.py:97
 msgid ""
 "\n"
 "\n"
 "EXAMPLES:\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:94
+#: ipalib/plugins/dns.py:100
 msgid ""
 "\n"
 " Add new zone:\n"
 "   ipa dnszone-add example.com --admin-email=admin@example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:97
+#: ipalib/plugins/dns.py:103
 msgid ""
 "\n"
 " Add system permission that can be used for per-zone privilege delegation:\n"
 "   ipa dnszone-add-permission example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:100
+#: ipalib/plugins/dns.py:106
 msgid ""
 "\n"
 " Modify the zone to allow dynamic updates for hosts own records in realm "
@@ -3714,7 +3806,7 @@ msgid ""
 "   ipa dnszone-mod example.com --dynamic-update=TRUE\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:103
+#: ipalib/plugins/dns.py:109
 msgid ""
 "\n"
 "   This is the equivalent of:\n"
@@ -3723,42 +3815,42 @@ msgid ""
 "krb5-self * AAAA; grant EXAMPLE.COM krb5-self * SSHFP;\"\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:107
+#: ipalib/plugins/dns.py:113
 msgid ""
 "\n"
 " Modify the zone to allow zone transfers for local network only:\n"
 "   ipa dnszone-mod example.com --allow-transfer=192.0.2.0/24\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:110
+#: ipalib/plugins/dns.py:116
 msgid ""
 "\n"
 " Add new reverse zone specified by network IP address:\n"
 "   ipa dnszone-add --name-from-ip=192.0.2.0/24\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:113
+#: ipalib/plugins/dns.py:119
 msgid ""
 "\n"
 " Add second nameserver for example.com:\n"
 "   ipa dnsrecord-add example.com @ --ns-rec=nameserver2.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:116
+#: ipalib/plugins/dns.py:122
 msgid ""
 "\n"
 " Add a mail server for example.com:\n"
 "   ipa dnsrecord-add example.com @ --mx-rec=\"10 mail1\"\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:119
+#: ipalib/plugins/dns.py:125
 msgid ""
 "\n"
 " Add another record using MX record specific options:\n"
 "  ipa dnsrecord-add example.com @ --mx-preference=20 --mx-exchanger=mail2\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:122
+#: ipalib/plugins/dns.py:128
 msgid ""
 "\n"
 " Add another record using interactive mode (started when dnsrecord-add, "
@@ -3776,14 +3868,14 @@ msgid ""
 "    NS record: nameserver.example.com., nameserver2.example.com.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:135
+#: ipalib/plugins/dns.py:141
 msgid ""
 "\n"
 " Delete previously added nameserver from example.com:\n"
 "   ipa dnsrecord-del example.com @ --ns-rec=nameserver2.example.com.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:138
+#: ipalib/plugins/dns.py:144
 msgid ""
 "\n"
 " Add LOC record for example.com:\n"
@@ -3791,7 +3883,7 @@ msgid ""
 "227.64m\"\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:141
+#: ipalib/plugins/dns.py:147
 msgid ""
 "\n"
 " Add new A record for www.example.com. Create a reverse record in "
@@ -3802,14 +3894,14 @@ msgid ""
 "   ipa dnsrecord-add example.com www --a-rec=192.0.2.2 --a-create-reverse\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:146
+#: ipalib/plugins/dns.py:152
 msgid ""
 "\n"
 " Add new PTR record for www.example.com\n"
 "   ipa dnsrecord-add 2.0.192.in-addr.arpa. 2 --ptr-rec=www.example.com.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:149
+#: ipalib/plugins/dns.py:155
 msgid ""
 "\n"
 " Add new SRV records for LDAP servers. Three quarters of the requests\n"
@@ -3823,7 +3915,7 @@ msgid ""
 "example.com\"\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:156
+#: ipalib/plugins/dns.py:162
 msgid ""
 "\n"
 " The interactive mode can be used for easy modification:\n"
@@ -3847,14 +3939,14 @@ msgid ""
 "389 slow.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:173
+#: ipalib/plugins/dns.py:179
 msgid ""
 "\n"
 " After this modification, three fifths of the requests should go to\n"
 " fast.example.com and two fifths to slow.example.com.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:176
+#: ipalib/plugins/dns.py:182
 msgid ""
 "\n"
 " An example of the interactive mode for dnsrecord-del command:\n"
@@ -3872,42 +3964,42 @@ msgid ""
 "deleted)\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:189
+#: ipalib/plugins/dns.py:195
 msgid ""
 "\n"
 " Show zone example.com:\n"
 "   ipa dnszone-show example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:192
+#: ipalib/plugins/dns.py:198
 msgid ""
 "\n"
 " Find zone with \"example\" in its domain name:\n"
 "   ipa dnszone-find example\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:195
+#: ipalib/plugins/dns.py:201
 msgid ""
 "\n"
 " Find records for resources with \"www\" in their name in zone example.com:\n"
 "   ipa dnsrecord-find example.com www\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:198
+#: ipalib/plugins/dns.py:204
 msgid ""
 "\n"
 " Find A records with value 192.0.2.2 in zone example.com\n"
 "   ipa dnsrecord-find example.com --a-rec=192.0.2.2\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:201
+#: ipalib/plugins/dns.py:207
 msgid ""
 "\n"
 " Show records for resource www in zone example.com\n"
 "   ipa dnsrecord-show example.com www\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:204
+#: ipalib/plugins/dns.py:210
 msgid ""
 "\n"
 " Delegate zone sub.example to another nameserver:\n"
@@ -3915,14 +4007,14 @@ msgid ""
 "   ipa dnsrecord-add example.com sub --ns-rec=ns.sub.example.com.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:208
+#: ipalib/plugins/dns.py:214
 msgid ""
 "\n"
 " Delete zone example.com with all resource records:\n"
 "   ipa dnszone-del example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:211
+#: ipalib/plugins/dns.py:217
 msgid ""
 "\n"
 " If a global forwarder is configured, all queries for which this server is "
@@ -3932,7 +4024,7 @@ msgid ""
 " Global forwarding configuration can be overridden per-zone.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:215
+#: ipalib/plugins/dns.py:221
 msgid ""
 "\n"
 " Semantics of forwarding in IPA matches BIND semantics and depends on the "
@@ -3949,7 +4041,7 @@ msgid ""
 "   forwarders.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:226
+#: ipalib/plugins/dns.py:232
 msgid ""
 "\n"
 " Semantics of the --forwarder-policy option:\n"
@@ -3960,14 +4052,14 @@ msgid ""
 "   return failure.\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:233
+#: ipalib/plugins/dns.py:239
 msgid ""
 "\n"
 " Disable global forwarding for given sub-tree:\n"
 "   ipa dnszone-mod example.com --forward-policy=none\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:236
+#: ipalib/plugins/dns.py:242
 msgid ""
 "\n"
 " This configuration forwards all queries for names outside the example.com\n"
@@ -3976,7 +4068,7 @@ msgid ""
 "etc.).\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:240
+#: ipalib/plugins/dns.py:246
 msgid ""
 "\n"
 " Forward all requests for the zone external.example.com to another "
@@ -3988,35 +4080,35 @@ msgid ""
 "                               --forwarder=203.0.113.1\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:246
+#: ipalib/plugins/dns.py:252
 msgid ""
 "\n"
 " Change forward-policy for external.example.com:\n"
 "   ipa dnsforwardzone-mod external.example.com --forward-policy=only\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:249
+#: ipalib/plugins/dns.py:255
 msgid ""
 "\n"
 " Show forward zone external.example.com:\n"
 "   ipa dnsforwardzone-show external.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:252
+#: ipalib/plugins/dns.py:258
 msgid ""
 "\n"
 " List all forward zones:\n"
 "   ipa dnsforwardzone-find\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:255
+#: ipalib/plugins/dns.py:261
 msgid ""
 "\n"
 " Delete forward zone external.example.com:\n"
 "   ipa dnsforwardzone-del external.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:258
+#: ipalib/plugins/dns.py:264
 msgid ""
 "\n"
 " Resolve a host name to see if it exists (will add default IPA domain\n"
@@ -4025,14 +4117,14 @@ msgid ""
 "   ipa dns-resolve www\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:263
+#: ipalib/plugins/dns.py:269
 msgid ""
 "\n"
 "\n"
 "GLOBAL DNS CONFIGURATION\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:266
+#: ipalib/plugins/dns.py:272
 msgid ""
 "\n"
 "DNS configuration passed to command line install script is stored in a "
@@ -4043,273 +4135,274 @@ msgid ""
 "server:\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:271
+#: ipalib/plugins/dns.py:277
 msgid ""
 "\n"
 " Show global DNS configuration:\n"
 "   ipa dnsconfig-show\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:274
+#: ipalib/plugins/dns.py:280
 msgid ""
 "\n"
 " Modify global DNS configuration and set a list of global forwarders:\n"
 "   ipa dnsconfig-mod --forwarder=203.0.113.113\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:314
+#: ipalib/plugins/dns.py:319
 msgid "Permission value"
 msgstr ""
 
-#: ipalib/plugins/dns.py:360
+#: ipalib/plugins/dns.py:365
 #, python-format
 msgid "invalid IP address version (is %(value)d, must be %(required_value)d)!"
 msgstr ""
 
-#: ipalib/plugins/dns.py:363
+#: ipalib/plugins/dns.py:368
 msgid "invalid IP address format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:376
+#: ipalib/plugins/dns.py:381
 msgid "invalid IP network format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:385
+#: ipalib/plugins/dns.py:390
 msgid "each ACL element must be terminated with a semicolon"
 msgstr ""
 
-#: ipalib/plugins/dns.py:402
+#: ipalib/plugins/dns.py:407
 msgid "invalid address format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:452
+#: ipalib/plugins/dns.py:457
 #, python-format
 msgid "%(port)s is not a valid port"
 msgstr ""
 
-#: ipalib/plugins/dns.py:463
+#: ipalib/plugins/dns.py:468
 msgid ""
 "expected format: <0-255> <0-255> <0-65535> even-"
 "length_hexadecimal_digits_or_hyphen"
 msgstr ""
 
-#: ipalib/plugins/dns.py:472
+#: ipalib/plugins/dns.py:477
 msgid "algorithm value: allowed interval 0-255"
 msgstr ""
 
-#: ipalib/plugins/dns.py:475
+#: ipalib/plugins/dns.py:480
 msgid "flags value: allowed interval 0-255"
 msgstr ""
 
-#: ipalib/plugins/dns.py:478
+#: ipalib/plugins/dns.py:483
 msgid "iterations value: allowed interval 0-65535"
 msgstr ""
 
-#: ipalib/plugins/dns.py:486
+#: ipalib/plugins/dns.py:491
 #, python-format
 msgid "salt value: %(err)s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:493
+#: ipalib/plugins/dns.py:498
 msgid "invalid domain-name: not fully qualified"
 msgstr ""
 
-#: ipalib/plugins/dns.py:502
+#: ipalib/plugins/dns.py:507
 msgid "should not be a wildcard domain name (RFC 4592 section 4)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:556
+#: ipalib/plugins/dns.py:550
 #, python-format
-msgid "DNS reverse zone for IP address %(addr)s not found"
+msgid ""
+"DNS reverse zone %(revzone)s for IP address %(addr)s is not managed by this "
+"server"
 msgstr ""
 
-#: ipalib/plugins/dns.py:571
+#: ipalib/plugins/dns.py:567
 #, python-format
 msgid "DNS zone %(zone)s not found"
 msgstr ""
 
-#: ipalib/plugins/dns.py:585
+#: ipalib/plugins/dns.py:581
 #, python-format
 msgid "IP address %(ip)s is already assigned in domain %(domain)s."
 msgstr ""
 
-#: ipalib/plugins/dns.py:598
+#: ipalib/plugins/dns.py:591
 #, python-format
 msgid ""
 "Reverse record for IP address %(ip)s already exists in reverse zone %(zone)s."
 msgstr ""
 
-#: ipalib/plugins/dns.py:675
+#: ipalib/plugins/dns.py:665
 #, python-format
 msgid "%s record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:677
+#: ipalib/plugins/dns.py:667
 #, python-format
 msgid "Raw %s records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:678
+#: ipalib/plugins/dns.py:668
 #, python-format
 msgid "%s Record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:679
+#: ipalib/plugins/dns.py:669
 #, python-format
 msgid "(see RFC %s for details)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:744
+#: ipalib/plugins/dns.py:734
 #, python-format
 msgid "'%s' is a required part of DNS record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:751
+#: ipalib/plugins/dns.py:741
 msgid "Invalid number of parts!"
 msgstr ""
 
-#: ipalib/plugins/dns.py:806
+#: ipalib/plugins/dns.py:796
 #, python-format
 msgid "DNS RR type \"%s\" is not supported by bind-dyndb-ldap plugin"
 msgstr ""
 
-#: ipalib/plugins/dns.py:822
+#: ipalib/plugins/dns.py:812
 #, python-format
 msgid "format must be specified as \"%(format)s\" %(rfcs)s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:947
+#: ipalib/plugins/dns.py:937
 msgid "Create reverse"
 msgstr ""
 
-#: ipalib/plugins/dns.py:948
+#: ipalib/plugins/dns.py:938
 msgid "Create reverse record for this IP Address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:983
+#: ipalib/plugins/dns.py:973
 #, python-format
 msgid "Cannot create reverse record for \"%(value)s\": %(exc)s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1003 ipalib/plugins/dns.py:1026
-#: ipalib/plugins/host.py:603
+#: ipalib/plugins/dns.py:993 ipalib/plugins/dns.py:1016
+#: ipalib/plugins/host.py:610
 msgid "IP Address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1012 ipalib/plugins/dns.py:1546
+#: ipalib/plugins/dns.py:1002 ipalib/plugins/dns.py:1538
 msgid "Record data"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1035
+#: ipalib/plugins/dns.py:1025
 msgid "Subtype"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1040 ipalib/plugins/dns.py:1077
-#: ipalib/plugins/dns.py:1312 ipalib/plugins/dns.py:1370
-#: ipalib/plugins/dns.py:4136
+#: ipalib/plugins/dns.py:1030 ipalib/plugins/dns.py:1067
+#: ipalib/plugins/dns.py:1316 ipalib/plugins/dns.py:1377
 msgid "Hostname"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1053
+#: ipalib/plugins/dns.py:1043
 msgid "Certificate Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1058 ipalib/plugins/dns.py:1104
+#: ipalib/plugins/dns.py:1048 ipalib/plugins/dns.py:1091
 msgid "Key Tag"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1063 ipalib/plugins/dns.py:1109
-#: ipalib/plugins/dns.py:1431 ipalib/plugins/otptoken.py:222
+#: ipalib/plugins/dns.py:1053 ipalib/plugins/dns.py:1096
+#: ipalib/plugins/dns.py:1438 ipalib/plugins/otptoken.py:226
 msgid "Algorithm"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1068
+#: ipalib/plugins/dns.py:1058
 msgid "Certificate/CRL"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1078
+#: ipalib/plugins/dns.py:1068
 msgid "A hostname which this alias hostname points to"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1091 ipalib/plugins/dns.py:1399
-#: ipalib/plugins/internal.py:594
+#: ipalib/plugins/dns.py:1081 ipalib/plugins/dns.py:1406
+#: ipalib/plugins/internal.py:613
 msgid "Target"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1114
+#: ipalib/plugins/dns.py:1101
 msgid "Digest Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1119
+#: ipalib/plugins/dns.py:1106
 msgid "Digest"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1150 ipalib/plugins/dns.py:1295
-#: ipalib/plugins/dns.py:1344
+#: ipalib/plugins/dns.py:1142 ipalib/plugins/dns.py:1299
+#: ipalib/plugins/dns.py:1345
 msgid "Preference"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1151 ipalib/plugins/dns.py:1296
+#: ipalib/plugins/dns.py:1143 ipalib/plugins/dns.py:1300
 msgid "Preference given to this exchanger. Lower values are more preferred"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1156 ipalib/plugins/dns.py:1301
+#: ipalib/plugins/dns.py:1148 ipalib/plugins/dns.py:1305
 msgid "Exchanger"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1157
+#: ipalib/plugins/dns.py:1149
 msgid "A host willing to act as a key exchanger"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1166
+#: ipalib/plugins/dns.py:1158
 msgid "Degrees Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1171
+#: ipalib/plugins/dns.py:1163
 msgid "Minutes Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1176
+#: ipalib/plugins/dns.py:1168
 msgid "Seconds Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1182
+#: ipalib/plugins/dns.py:1174
 msgid "Direction Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1186
+#: ipalib/plugins/dns.py:1178
 msgid "Degrees Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1191
+#: ipalib/plugins/dns.py:1183
 msgid "Minutes Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1196
+#: ipalib/plugins/dns.py:1188
 msgid "Seconds Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1202
+#: ipalib/plugins/dns.py:1194
 msgid "Direction Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1206
+#: ipalib/plugins/dns.py:1198
 msgid "Altitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1212
+#: ipalib/plugins/dns.py:1204
 msgid "Size"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1218
+#: ipalib/plugins/dns.py:1210
 msgid "Horizontal Precision"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1224
+#: ipalib/plugins/dns.py:1216
 msgid "Vertical Precision"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1231
+#: ipalib/plugins/dns.py:1223
 msgid ""
 "format must be specified as\n"
 "    \"d1 [m1 [s1]] {\"N\"|\"S\"}  d2 [m2 [s2]] {\"E\"|\"W\"} alt[\"m\"] "
@@ -4324,566 +4417,557 @@ msgid ""
 "    See RFC 1876 for details"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1285
+#: ipalib/plugins/dns.py:1277
 #, python-format
 msgid "'%(required)s' must not be empty when '%(name)s' is set"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1302
+#: ipalib/plugins/dns.py:1306
 msgid "A host willing to act as a mail exchanger"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1331
+#: ipalib/plugins/dns.py:1332
 msgid "flags must be one of \"S\", \"A\", \"U\", or \"P\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:1339
+#: ipalib/plugins/dns.py:1340
 msgid "Order"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1350
+#: ipalib/plugins/dns.py:1351
 msgid "Flags"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1354 ipalib/plugins/hbactest.py:269
-#: ipalib/plugins/internal.py:646 ipalib/plugins/service.py:441
+#: ipalib/plugins/dns.py:1355 ipalib/plugins/hbactest.py:272
+#: ipalib/plugins/internal.py:665 ipalib/plugins/service.py:471
 msgid "Service"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1357
+#: ipalib/plugins/dns.py:1358
 msgid "Regular Expression"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1360
+#: ipalib/plugins/dns.py:1361
 msgid "Replacement"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1371
+#: ipalib/plugins/dns.py:1378
 msgid "The hostname this reverse record points to"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1384 ipalib/plugins/pwpolicy.py:351
+#: ipalib/plugins/dns.py:1391 ipalib/plugins/pwpolicy.py:356
 msgid "Priority"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1389
+#: ipalib/plugins/dns.py:1396
 msgid "Weight"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1394
+#: ipalib/plugins/dns.py:1401
 msgid "Port"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1400
+#: ipalib/plugins/dns.py:1407
 msgid ""
 "The domain name of the target host or '.' if the service is decidedly not "
 "available at this domain"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1409
+#: ipalib/plugins/dns.py:1416
 msgid "the value does not follow \"YYYYMMDDHHMMSS\" time format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1436
+#: ipalib/plugins/dns.py:1443
 msgid "Fingerprint Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1441
+#: ipalib/plugins/dns.py:1448
 msgid "Fingerprint"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1462
+#: ipalib/plugins/dns.py:1465
 msgid "Certificate Usage"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1467
+#: ipalib/plugins/dns.py:1470
 msgid "Selector"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1472
+#: ipalib/plugins/dns.py:1475
 msgid "Matching Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1477
+#: ipalib/plugins/dns.py:1480
 msgid "Certificate Association Data"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1493
+#: ipalib/plugins/dns.py:1490
 msgid "Text Data"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1540
+#: ipalib/plugins/dns.py:1532
 msgid "Records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1543
+#: ipalib/plugins/dns.py:1535
 msgid "Record type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1578
+#: ipalib/plugins/dns.py:1568
 #, python-format
 msgid "Nameserver '%(host)s' does not have a corresponding A/AAAA record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1597
+#: ipalib/plugins/dns.py:1614
 msgid "Managedby permission"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1986
+#: ipalib/plugins/dns.py:2003
 msgid "Zone name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1987
+#: ipalib/plugins/dns.py:2004
 msgid "Zone name (FQDN)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1993
+#: ipalib/plugins/dns.py:2010
 msgid "Reverse zone IP network"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1994
+#: ipalib/plugins/dns.py:2011
 msgid "IP network to create reverse zone name from"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1999
+#: ipalib/plugins/dns.py:2016
 msgid "Active zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2000
+#: ipalib/plugins/dns.py:2017
 msgid "Is zone active?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2007
+#: ipalib/plugins/dns.py:2024
 msgid "Zone forwarders"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2008
+#: ipalib/plugins/dns.py:2025
 msgid ""
 "Per-zone forwarders. A custom port can be specified for each forwarder using "
 "a standard format \"IP_ADDRESS port PORT\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2014 ipalib/plugins/dns.py:4205
+#: ipalib/plugins/dns.py:2031 ipalib/plugins/dns.py:4266
 msgid "Forward policy"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2015
+#: ipalib/plugins/dns.py:2032
 msgid ""
 "Per-zone conditional forwarding policy. Set to \"none\" to disable "
 "forwarding to global forwarder for this zone. In that case, conditional zone "
 "forwarders are disregarded."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2105
+#: ipalib/plugins/dns.py:2042 ipalib/plugins/dns.py:2201
+#: ipalib/plugins/dns.py:3119 ipalib/plugins/dns.py:4314
 msgid "DNS is not configured"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2116
+#: ipalib/plugins/dns.py:2135
 msgid "Only one zone type is allowed per zone name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2151 ipalib/plugins/dns.py:2835
+#: ipalib/plugins/dns.py:2170 ipalib/plugins/dns.py:2862
 msgid "Search for DNS zones (SOA records)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2248
+#: ipalib/plugins/dns.py:2278
 #, python-format
 msgid "Added system permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2276
+#: ipalib/plugins/dns.py:2307
 #, python-format
 msgid "permission \"%(value)s\" already exists"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2304
+#: ipalib/plugins/dns.py:2335
 #, python-format
 msgid "Removed system permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2340
+#: ipalib/plugins/dns.py:2371
 msgid "DNS zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2341
+#: ipalib/plugins/dns.py:2372
 msgid "DNS zones"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2348
+#: ipalib/plugins/dns.py:2379
 msgid "DNS Zones"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2349
+#: ipalib/plugins/dns.py:2380
 msgid "DNS Zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2354
+#: ipalib/plugins/dns.py:2385
 msgid "Authoritative nameserver"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2355
+#: ipalib/plugins/dns.py:2386
 msgid "Authoritative nameserver domain name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2361 ipalib/plugins/dns.py:2362
+#: ipalib/plugins/dns.py:2392 ipalib/plugins/dns.py:2393
 msgid "Administrator e-mail address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2369
+#: ipalib/plugins/dns.py:2400
 msgid "SOA serial"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2370
+#: ipalib/plugins/dns.py:2401
 msgid "SOA record serial number"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2378
+#: ipalib/plugins/dns.py:2409
 msgid "SOA refresh"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2379
+#: ipalib/plugins/dns.py:2410
 msgid "SOA record refresh time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2387
+#: ipalib/plugins/dns.py:2418
 msgid "SOA retry"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2388
+#: ipalib/plugins/dns.py:2419
 msgid "SOA record retry time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2396
+#: ipalib/plugins/dns.py:2427
 msgid "SOA expire"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2397
+#: ipalib/plugins/dns.py:2428
 msgid "SOA record expire time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2405
+#: ipalib/plugins/dns.py:2436
 msgid "SOA minimum"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2406
+#: ipalib/plugins/dns.py:2437
 msgid "How long should negative responses be cached"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2414 ipalib/plugins/dns.py:2949
-#: ipalib/plugins/dns.py:2950
+#: ipalib/plugins/dns.py:2445 ipalib/plugins/dns.py:2977
+#: ipalib/plugins/dns.py:2978
 msgid "Time to live"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2415
+#: ipalib/plugins/dns.py:2446
 msgid "Time to live for records at zone apex"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2427 ipalib/plugins/dns.py:2428
+#: ipalib/plugins/dns.py:2458 ipalib/plugins/dns.py:2459
 msgid "BIND update policy"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2434
+#: ipalib/plugins/dns.py:2465
 msgid "Dynamic update"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2435
+#: ipalib/plugins/dns.py:2466
 msgid "Allow dynamic updates."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2444
+#: ipalib/plugins/dns.py:2475
 msgid "Allow query"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2445
+#: ipalib/plugins/dns.py:2476
 msgid ""
 "Semicolon separated list of IP addresses or networks which are allowed to "
 "issue queries"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2453
+#: ipalib/plugins/dns.py:2484
 msgid "Allow transfer"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2454
+#: ipalib/plugins/dns.py:2485
 msgid ""
 "Semicolon separated list of IP addresses or networks which are allowed to "
 "transfer the zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2460 ipalib/plugins/dns.py:4212
+#: ipalib/plugins/dns.py:2491 ipalib/plugins/dns.py:4273
 msgid "Allow PTR sync"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2461
+#: ipalib/plugins/dns.py:2492
 msgid ""
 "Allow synchronization of forward (A, AAAA) and reverse (PTR) records in the "
 "zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2466
+#: ipalib/plugins/dns.py:2497
 msgid "Allow in-line DNSSEC signing"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2467
+#: ipalib/plugins/dns.py:2498
 msgid "Allow inline DNSSEC signing of records in the zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2472
+#: ipalib/plugins/dns.py:2503
 msgid "NSEC3PARAM record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2473
+#: ipalib/plugins/dns.py:2504
 msgid ""
 "NSEC3PARAM record for zone in format: hash_algorithm flags iterations salt"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2626
-msgid "Visit 'http://www.freeipa.org/page/Releases/4.1.0#DNSSEC_Support'."
-msgstr ""
-
-#: ipalib/plugins/dns.py:2631
-msgid ""
-"If you encounter any problems please report them and restart 'named' service "
-"on affected IPA server."
-msgstr ""
-
-#: ipalib/plugins/dns.py:2641
+#: ipalib/plugins/dns.py:2658
 msgid "setting Authoritative nameserver"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2642
+#: ipalib/plugins/dns.py:2659
 msgid "It is used only for setting the SOA MNAME attribute."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2644
+#: ipalib/plugins/dns.py:2661
 msgid "NS record(s) can be edited in zone apex - '@'. "
 msgstr ""
 
-#: ipalib/plugins/dns.py:2666
+#: ipalib/plugins/dns.py:2692
 msgid "Create new DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2670 ipalib/plugins/dns.py:2797
-#: ipalib/plugins/dns.py:3504 ipalib/plugins/host.py:595
-#: ipalib/plugins/permission.py:1041 ipalib/plugins/realmdomains.py:124
-#: ipalib/plugins/service.py:497
+#: ipalib/plugins/dns.py:2696 ipalib/plugins/dns.py:2824
+#: ipalib/plugins/dns.py:3553 ipalib/plugins/host.py:602
+#: ipalib/plugins/permission.py:1047 ipalib/plugins/realmdomains.py:129
+#: ipalib/plugins/service.py:527
 msgid "Force"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2671
+#: ipalib/plugins/dns.py:2697
 msgid "Force DNS zone creation even if nameserver is not resolvable."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2706
+#: ipalib/plugins/dns.py:2733
 msgid "Nameserver for reverse zone cannot be a relative DNS name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2760
+#: ipalib/plugins/dns.py:2787
 msgid "Delete DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2762
+#: ipalib/plugins/dns.py:2789
 #, python-format
 msgid "Deleted DNS zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2793
+#: ipalib/plugins/dns.py:2820
 msgid "Modify DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2798
+#: ipalib/plugins/dns.py:2825
 msgid "Force nameserver change even if nameserver not in DNS"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2815
+#: ipalib/plugins/dns.py:2842
 msgid "is required"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2839
+#: ipalib/plugins/dns.py:2866
 msgid "Forward zones only"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2841
+#: ipalib/plugins/dns.py:2868
 msgid "Search for forward zones only"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2876
+#: ipalib/plugins/dns.py:2903
 msgid "Display information about a DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2893
+#: ipalib/plugins/dns.py:2921
 msgid "Disable DNS Zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2894
+#: ipalib/plugins/dns.py:2922
 #, python-format
 msgid "Disabled DNS zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2904
+#: ipalib/plugins/dns.py:2932
 msgid "Enable DNS Zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2905
+#: ipalib/plugins/dns.py:2933
 #, python-format
 msgid "Enabled DNS zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2915
+#: ipalib/plugins/dns.py:2943
 msgid "Add a permission for per-zone access delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2920
+#: ipalib/plugins/dns.py:2948
 msgid "Remove a permission for per-zone access delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2930
+#: ipalib/plugins/dns.py:2958
 msgid "DNS resource record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2931
+#: ipalib/plugins/dns.py:2959
 msgid "DNS resource records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2937
+#: ipalib/plugins/dns.py:2965
 msgid "DNS Resource Records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2938
+#: ipalib/plugins/dns.py:2966
 msgid "DNS Resource Record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2943 ipalib/plugins/dns.py:2944
+#: ipalib/plugins/dns.py:2971 ipalib/plugins/dns.py:2972
 msgid "Record name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2961
+#: ipalib/plugins/dns.py:2989
 msgid "Structured"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2962
+#: ipalib/plugins/dns.py:2990
 msgid "Parse all raw DNS records and return them in a structured way"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2971
+#: ipalib/plugins/dns.py:2999
 msgid "DS record must not be in zone apex (RFC 4035 section 2.4)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2988
+#: ipalib/plugins/dns.py:3016
 msgid ""
 "out-of-zone data: record name must be a subdomain of the zone or a relative "
 "name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2999
+#: ipalib/plugins/dns.py:3027
 #, python-format
 msgid ""
 "owner of %(types)s records should not be a wildcard domain name (RFC 4592 "
 "section 4)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3028
+#: ipalib/plugins/dns.py:3056
 #, python-format
 msgid ""
 "Reverse zone for PTR record should be a sub-zone of one the following fully "
 "qualified domains: %s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3043
+#: ipalib/plugins/dns.py:3071
 #, python-format
 msgid ""
 "Reverse zone %(name)s requires exactly %(count)d IP address components, "
 "%(user_count)d given"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3084
+#: ipalib/plugins/dns.py:3112
 msgid "only master zones can contain records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3254
+#: ipalib/plugins/dns.py:3285
 msgid "only one CNAME record is allowed per name (RFC 2136, section 1.1.5)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3260
+#: ipalib/plugins/dns.py:3291
 msgid ""
 "CNAME record is not allowed to coexist with any other record (RFC 1034, "
 "section 3.6.2)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3268
+#: ipalib/plugins/dns.py:3299
 msgid "only one DNAME record is allowed per name (RFC 6672, section 2.4)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3284
+#: ipalib/plugins/dns.py:3315
 #, python-format
 msgid ""
 "NS record is not allowed to coexist with an %(type)s record except when "
 "located in a zone root record (RFC 2181, section 6.1)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3300
+#: ipalib/plugins/dns.py:3331
 msgid ""
 "DS record requires to coexist with an NS record (RFC 4592 section 4.6, RFC "
 "4035 section 2.4)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3498
+#: ipalib/plugins/dns.py:3547
 msgid "Add new DNS resource record."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3506
+#: ipalib/plugins/dns.py:3555
 msgid "force NS record creation even if its hostname is not in DNS"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3553
+#: ipalib/plugins/dns.py:3602
 msgid "Please choose a type of DNS resource record to be added"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3554
+#: ipalib/plugins/dns.py:3603
 #, python-format
 msgid "The most common types for this type of zone are: %s\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3559
+#: ipalib/plugins/dns.py:3608
 msgid "DNS resource record type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3575
+#: ipalib/plugins/dns.py:3624
 #, python-format
 msgid "Invalid or unsupported type. Allowed values are: %s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3603
+#: ipalib/plugins/dns.py:3652
 #, python-format
 msgid "Raw value of a DNS record was already set by \"%(name)s\" option"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3707
+#: ipalib/plugins/dns.py:3761
 msgid "Modify a DNS resource record."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3724
+#: ipalib/plugins/dns.py:3778
 msgid "DNS zone root record cannot be renamed"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3742
+#: ipalib/plugins/dns.py:3796
 msgid "DNS records can be only updated one at a time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3845
+#: ipalib/plugins/dns.py:3899
 msgid "No option to modify specific record provided."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3848 ipalib/plugins/dns.py:4041
+#: ipalib/plugins/dns.py:3902 ipalib/plugins/dns.py:4095
 msgid "Current DNS record contents:\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3870
+#: ipalib/plugins/dns.py:3924
 #, python-format
 msgid "Modify %(name)s '%(value)s'?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3878
+#: ipalib/plugins/dns.py:3932
 #, python-format
 msgid ""
 "%(count)d %(type)s record skipped. Only one value per DNS record type can be "
@@ -4894,187 +4978,191 @@ msgid_plural ""
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/dns.py:3890
+#: ipalib/plugins/dns.py:3944
 #, python-format
 msgid "Deleted record \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:3897
+#: ipalib/plugins/dns.py:3951
 msgid "Delete DNS resource record."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3901
+#: ipalib/plugins/dns.py:3955
 msgid ""
 "Neither --del-all nor options to delete a specific record provided.\n"
 "Command help may be consulted for all supported record types."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3907
+#: ipalib/plugins/dns.py:3961
 msgid "Delete all associated records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3979
+#: ipalib/plugins/dns.py:4033
 #, python-format
 msgid "Zone record '%s' cannot be deleted"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4033
+#: ipalib/plugins/dns.py:4087
 msgid "No option to delete specific record provided."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4034
+#: ipalib/plugins/dns.py:4088
 msgid "Delete all?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4062
+#: ipalib/plugins/dns.py:4116
 #, python-format
 msgid "Delete %(name)s '%(value)s'?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4073
+#: ipalib/plugins/dns.py:4127
 msgid "Display DNS resource."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4090
+#: ipalib/plugins/dns.py:4144
 msgid "Search for DNS resources."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4129
-msgid "Resolve a host name in DNS."
+#: ipalib/plugins/dns.py:4183
+msgid "Resolve a host name in DNS. (Deprecated)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4132
+#: ipalib/plugins/dns.py:4188
 #, python-format
 msgid "Found '%(value)s'"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4149
+#: ipalib/plugins/dns.py:4192
+msgid "Hostname (FQDN)"
+msgstr ""
+
+#: ipalib/plugins/dns.py:4201
 #, python-format
 msgid "Host '%(host)s' not found"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4186
+#: ipalib/plugins/dns.py:4247
 msgid "DNS configuration options"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4191 ipalib/plugins/dns.py:4192
+#: ipalib/plugins/dns.py:4252 ipalib/plugins/dns.py:4253
 msgid "DNS Global Configuration"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4198
+#: ipalib/plugins/dns.py:4259
 msgid "Global forwarders"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4199
+#: ipalib/plugins/dns.py:4260
 msgid ""
 "Global forwarders. A custom port can be specified for each forwarder using a "
 "standard format \"IP_ADDRESS port PORT\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:4206
+#: ipalib/plugins/dns.py:4267
 msgid ""
 "Global forwarding policy. Set to \"none\" to disable any configured global "
 "forwarders."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4213
+#: ipalib/plugins/dns.py:4274
 msgid "Allow synchronization of forward (A, AAAA) and reverse (PTR) records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4217
+#: ipalib/plugins/dns.py:4278
 msgid "Zone refresh interval"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4261
+#: ipalib/plugins/dns.py:4324
 msgid "Global DNS configuration is empty"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4267
+#: ipalib/plugins/dns.py:4330
 msgid "Modify global DNS configuration."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4275 ipalib/plugins/dns.py:4436
-#: ipalib/plugins/dns.py:4482
+#: ipalib/plugins/dns.py:4338 ipalib/plugins/dns.py:4499
+#: ipalib/plugins/dns.py:4544
 msgid "Server will check DNS forwarder(s)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4277 ipalib/plugins/dns.py:4438
-#: ipalib/plugins/dns.py:4484
+#: ipalib/plugins/dns.py:4340 ipalib/plugins/dns.py:4501
+#: ipalib/plugins/dns.py:4546
 msgid "This may take some time, please wait ..."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4318
+#: ipalib/plugins/dns.py:4381
 msgid "Show the current global DNS configuration."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4331
+#: ipalib/plugins/dns.py:4394
 msgid "DNS forward zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4332
+#: ipalib/plugins/dns.py:4395
 msgid "DNS forward zones"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4334
+#: ipalib/plugins/dns.py:4397
 msgid "DNS Forward Zones"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4335
+#: ipalib/plugins/dns.py:4398
 msgid "DNS Forward Zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:4429
+#: ipalib/plugins/dns.py:4492
 msgid "Create new DNS forward zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4452 ipalib/plugins/dns.py:4510
+#: ipalib/plugins/dns.py:4515 ipalib/plugins/dns.py:4572
 msgid "Please specify forwarders."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4468
+#: ipalib/plugins/dns.py:4530
 msgid "Delete DNS forward zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4470
+#: ipalib/plugins/dns.py:4532
 #, python-format
 msgid "Deleted DNS forward zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:4475
+#: ipalib/plugins/dns.py:4537
 msgid "Modify DNS forward zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4523
+#: ipalib/plugins/dns.py:4585
 msgid "Search for DNS forward zones."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4528
+#: ipalib/plugins/dns.py:4590
 msgid "Display information about a DNS forward zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4535
+#: ipalib/plugins/dns.py:4597
 msgid "Disable DNS Forward Zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4536
+#: ipalib/plugins/dns.py:4598
 #, python-format
 msgid "Disabled DNS forward zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:4541
+#: ipalib/plugins/dns.py:4603
 msgid "Enable DNS Forward Zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4542
+#: ipalib/plugins/dns.py:4604
 #, python-format
 msgid "Enabled DNS forward zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:4552
+#: ipalib/plugins/dns.py:4614
 msgid "Add a permission for per-forward zone access delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:4557
+#: ipalib/plugins/dns.py:4619
 msgid "Remove a permission for per-forward zone access delegation."
 msgstr ""
 
@@ -5096,8 +5184,8 @@ msgstr ""
 msgid "Change current Domain Level."
 msgstr ""
 
-#: ipalib/plugins/domainlevel.py:99 ipalib/plugins/internal.py:456
-#: ipalib/plugins/internal.py:457
+#: ipalib/plugins/domainlevel.py:99 ipalib/plugins/internal.py:475
+#: ipalib/plugins/internal.py:476
 msgid "Domain Level"
 msgstr ""
 
@@ -5110,7 +5198,7 @@ msgstr ""
 msgid "Domain Level cannot be raised to {0}, server {1} does not support it."
 msgstr ""
 
-#: ipalib/plugins/group.py:34
+#: ipalib/plugins/group.py:41
 msgid ""
 "\n"
 "Groups of users\n"
@@ -5202,163 +5290,163 @@ msgid ""
 "   ipa group-show ad_admins_external\n"
 msgstr ""
 
-#: ipalib/plugins/group.py:125 ipalib/plugins/group.py:315
-#: ipalib/plugins/group.py:552 ipalib/plugins/user.py:115
+#: ipalib/plugins/group.py:132 ipalib/plugins/group.py:322
+#: ipalib/plugins/group.py:563 ipalib/plugins/user.py:123
 msgid "group"
 msgstr ""
 
-#: ipalib/plugins/group.py:126
+#: ipalib/plugins/group.py:133
 msgid "groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:228
+#: ipalib/plugins/group.py:235
 msgid "User Group"
 msgstr ""
 
-#: ipalib/plugins/group.py:236 ipalib/plugins/idviews.py:770
+#: ipalib/plugins/group.py:243 ipalib/plugins/idviews.py:925
 msgid "Group name"
 msgstr ""
 
-#: ipalib/plugins/group.py:243 ipalib/plugins/sudocmdgroup.py:123
+#: ipalib/plugins/group.py:250 ipalib/plugins/sudocmdgroup.py:123
 msgid "Group description"
 msgstr ""
 
-#: ipalib/plugins/group.py:248
+#: ipalib/plugins/group.py:255
 msgid "GID (use this option to set it manually)"
 msgstr ""
 
-#: ipalib/plugins/group.py:256
+#: ipalib/plugins/group.py:263
 msgid "External member"
 msgstr ""
 
-#: ipalib/plugins/group.py:257
+#: ipalib/plugins/group.py:264
 msgid "Members of a trusted domain in DOM\\name or name@domain form"
 msgstr ""
 
-#: ipalib/plugins/group.py:265
+#: ipalib/plugins/group.py:272
 msgid "Create a new group."
 msgstr ""
 
-#: ipalib/plugins/group.py:267
+#: ipalib/plugins/group.py:274
 #, python-format
 msgid "Added group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:272
+#: ipalib/plugins/group.py:279
 msgid "Create as a non-POSIX group"
 msgstr ""
 
-#: ipalib/plugins/group.py:277
+#: ipalib/plugins/group.py:284
 msgid "Allow adding external non-IPA members from trusted domains"
 msgstr ""
 
-#: ipalib/plugins/group.py:290
+#: ipalib/plugins/group.py:297
 msgid "gid cannot be set for external group"
 msgstr ""
 
-#: ipalib/plugins/group.py:300
+#: ipalib/plugins/group.py:307
 msgid "Delete group."
 msgstr ""
 
-#: ipalib/plugins/group.py:302
+#: ipalib/plugins/group.py:309
 #, python-format
 msgid "Deleted group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:316
+#: ipalib/plugins/group.py:323
 msgid "privileged group"
 msgstr ""
 
-#: ipalib/plugins/group.py:333
+#: ipalib/plugins/group.py:344
 msgid "Modify a group."
 msgstr ""
 
-#: ipalib/plugins/group.py:335
+#: ipalib/plugins/group.py:346
 #, python-format
 msgid "Modified group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:340
+#: ipalib/plugins/group.py:351
 msgid "change to a POSIX group"
 msgstr ""
 
-#: ipalib/plugins/group.py:344
+#: ipalib/plugins/group.py:355
 msgid "change to support external non-IPA members from trusted domains"
 msgstr ""
 
-#: ipalib/plugins/group.py:404
+#: ipalib/plugins/group.py:415
 msgid "Search for groups."
 msgstr ""
 
-#: ipalib/plugins/group.py:409
+#: ipalib/plugins/group.py:420
 #, python-format
 msgid "%(count)d group matched"
 msgid_plural "%(count)d groups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/group.py:415
+#: ipalib/plugins/group.py:426
 msgid "search for private groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:419
+#: ipalib/plugins/group.py:430
 msgid "search for POSIX groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:423
+#: ipalib/plugins/group.py:434
 msgid ""
 "search for groups with support of external non-IPA members from trusted "
 "domains"
 msgstr ""
 
-#: ipalib/plugins/group.py:427
+#: ipalib/plugins/group.py:438
 msgid "search for non-POSIX groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:473
+#: ipalib/plugins/group.py:484
 msgid "Display information about a named group."
 msgstr ""
 
-#: ipalib/plugins/group.py:494
+#: ipalib/plugins/group.py:505
 msgid "Add members to a group."
 msgstr ""
 
-#: ipalib/plugins/group.py:503 ipalib/plugins/group.py:560
-#: ipalib/plugins/hbactest.py:386
+#: ipalib/plugins/group.py:514 ipalib/plugins/group.py:571
+#: ipalib/plugins/hbactest.py:389
 msgid ""
 "Cannot perform external member validation without Samba 4 support installed. "
 "Make sure you have installed server-trust-ad sub-package of IPA on the server"
 msgstr ""
 
-#: ipalib/plugins/group.py:508 ipalib/plugins/group.py:565
-#: ipalib/plugins/trust.py:587 ipalib/plugins/trust.py:1362
+#: ipalib/plugins/group.py:519 ipalib/plugins/group.py:576
+#: ipalib/plugins/trust.py:780 ipalib/plugins/trust.py:1596
 msgid ""
 "Cannot perform join operation without own domain configured. Make sure you "
 "have run ipa-adtrust-install on the IPA server first"
 msgstr ""
 
-#: ipalib/plugins/group.py:539
+#: ipalib/plugins/group.py:550
 msgid "Remove members from a group."
 msgstr ""
 
-#: ipalib/plugins/group.py:596
+#: ipalib/plugins/group.py:607
 msgid "Detach a managed group from a user."
 msgstr ""
 
-#: ipalib/plugins/group.py:599
+#: ipalib/plugins/group.py:610
 #, python-format
 msgid "Detached group \"%(value)s\" from user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:620
+#: ipalib/plugins/group.py:631
 msgid "not allowed to modify user entries"
 msgstr ""
 
-#: ipalib/plugins/group.py:626
+#: ipalib/plugins/group.py:637
 msgid "not allowed to modify group entries"
 msgstr ""
 
-#: ipalib/plugins/group.py:645
+#: ipalib/plugins/group.py:656
 msgid "Not a managed group"
 msgstr ""
 
@@ -5438,7 +5526,7 @@ msgid "HBAC Rule"
 msgstr ""
 
 #: ipalib/plugins/hbacrule.py:194 ipalib/plugins/selinuxusermap.py:201
-#: ipalib/plugins/sudorule.py:218
+#: ipalib/plugins/sudorule.py:222
 msgid "Rule name"
 msgstr ""
 
@@ -5450,13 +5538,13 @@ msgstr ""
 msgid "Rule type"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:211 ipalib/plugins/netgroup.py:207
-#: ipalib/plugins/selinuxusermap.py:216 ipalib/plugins/sudorule.py:232
+#: ipalib/plugins/hbacrule.py:211 ipalib/plugins/netgroup.py:215
+#: ipalib/plugins/selinuxusermap.py:216 ipalib/plugins/sudorule.py:236
 msgid "User category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:217 ipalib/plugins/netgroup.py:213
-#: ipalib/plugins/selinuxusermap.py:222 ipalib/plugins/sudorule.py:238
+#: ipalib/plugins/hbacrule.py:217 ipalib/plugins/netgroup.py:221
+#: ipalib/plugins/selinuxusermap.py:222 ipalib/plugins/sudorule.py:242
 msgid "Host category the rule applies to"
 msgstr ""
 
@@ -5601,7 +5689,7 @@ msgstr ""
 msgid "HBAC Service"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:101 ipalib/plugins/vault.py:149
+#: ipalib/plugins/hbacsvc.py:101
 msgid "Service name"
 msgstr ""
 
@@ -5748,7 +5836,7 @@ msgstr ""
 msgid "Remove members from an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:36
+#: ipalib/plugins/hbactest.py:39
 msgid ""
 "\n"
 "Simulate use of Host-based access controls\n"
@@ -5946,75 +6034,75 @@ msgid ""
 "      Not matched rules: can_login\n"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:245
+#: ipalib/plugins/hbactest.py:248
 msgid "Simulate use of Host-based access controls"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:249
+#: ipalib/plugins/hbactest.py:252
 msgid "Warning"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:250
+#: ipalib/plugins/hbactest.py:253
 msgid "Matched rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:251
+#: ipalib/plugins/hbactest.py:254
 msgid "Not matched rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:252
+#: ipalib/plugins/hbactest.py:255
 msgid "Non-existent or invalid rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:253
+#: ipalib/plugins/hbactest.py:256
 msgid "Result of simulation"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:259 ipalib/plugins/krbtpolicy.py:124
+#: ipalib/plugins/hbactest.py:262 ipalib/plugins/krbtpolicy.py:124
 #: ipalib/plugins/passwd.py:74
 msgid "User name"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:265
+#: ipalib/plugins/hbactest.py:268
 msgid "Target host"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:273
+#: ipalib/plugins/hbactest.py:276
 msgid "Rules to test. If not specified, --enabled is assumed"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:278
+#: ipalib/plugins/hbactest.py:281
 msgid "Hide details which rules are matched, not matched, or invalid"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:282
+#: ipalib/plugins/hbactest.py:285
 msgid "Include all enabled IPA rules into test [default]"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:286
+#: ipalib/plugins/hbactest.py:289
 msgid "Include all disabled IPA rules into test"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:290
+#: ipalib/plugins/hbactest.py:293
 msgid "Maximum number of rules to process when no --rules is specified"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:368
+#: ipalib/plugins/hbactest.py:371
 msgid "Unresolved rules in --rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:392 ipalib/plugins/trust.py:230
+#: ipalib/plugins/hbactest.py:395 ipalib/plugins/trust.py:347
 msgid ""
 "Cannot search in trusted domains without own domain configured. Make sure "
 "you have run ipa-adtrust-install on the IPA server first"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:478
+#: ipalib/plugins/hbactest.py:482
 #, python-format
 msgid "Access granted: %s"
 msgstr ""
 
-#: ipalib/plugins/host.py:50
+#: ipalib/plugins/host.py:57
 msgid ""
 "\n"
 "Hosts/Machines\n"
@@ -6026,7 +6114,7 @@ msgid ""
 "- every enrolled client generates a host entry\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:58
+#: ipalib/plugins/host.py:65
 msgid ""
 "\n"
 "ENROLLMENT:\n"
@@ -6042,7 +6130,7 @@ msgid ""
 "3. The host has been created with a one-time password.\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:70
+#: ipalib/plugins/host.py:77
 msgid ""
 "\n"
 "RE-ENROLLMENT:\n"
@@ -6057,7 +6145,7 @@ msgid ""
 "the OS that it runs, etc.\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:82
+#: ipalib/plugins/host.py:89
 msgid ""
 "\n"
 " Add a new host:\n"
@@ -6065,336 +6153,356 @@ msgid ""
 "com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:85
+#: ipalib/plugins/host.py:92
 msgid ""
 "\n"
 " Delete a host:\n"
 "   ipa host-del test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:88
+#: ipalib/plugins/host.py:95
 msgid ""
 "\n"
 " Add a new host with a one-time password:\n"
 "   ipa host-add --os='Fedora 12' --password=Secret123 test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:91
+#: ipalib/plugins/host.py:98
 msgid ""
 "\n"
 " Add a new host with a random one-time password:\n"
 "   ipa host-add --os='Fedora 12' --random test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:94
+#: ipalib/plugins/host.py:101
 msgid ""
 "\n"
 " Modify information about a host:\n"
 "   ipa host-mod --os='Fedora 12' test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:97
+#: ipalib/plugins/host.py:104
 msgid ""
 "\n"
 " Remove SSH public keys of a host and update DNS to reflect this change:\n"
 "   ipa host-mod --sshpubkey= --updatedns test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:100
+#: ipalib/plugins/host.py:107
 msgid ""
 "\n"
 " Disable the host Kerberos key, SSL certificate and all of its services:\n"
 "   ipa host-disable test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:103
+#: ipalib/plugins/host.py:110
 msgid ""
 "\n"
 " Add a host that can manage this host's keytab and certificate:\n"
 "   ipa host-add-managedby --hosts=test2 test\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:106
+#: ipalib/plugins/host.py:113
 msgid ""
 "\n"
 " Allow user to create a keytab:\n"
 "   ipa host-allow-create-keytab test2 --users=tuser1\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:178 ipalib/plugins/service.py:102
+#: ipalib/plugins/host.py:185 ipalib/plugins/service.py:107
 msgid "Keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:190 ipalib/plugins/internal.py:399
-#: ipalib/plugins/service.py:111
+#: ipalib/plugins/host.py:197 ipalib/plugins/internal.py:418
+#: ipalib/plugins/service.py:116
 msgid "Serial Number"
 msgstr ""
 
-#: ipalib/plugins/host.py:193 ipalib/plugins/internal.py:400
-#: ipalib/plugins/service.py:114
+#: ipalib/plugins/host.py:200 ipalib/plugins/internal.py:419
+#: ipalib/plugins/service.py:119
 msgid "Serial Number (hex)"
 msgstr ""
 
-#: ipalib/plugins/host.py:214
+#: ipalib/plugins/host.py:221
 msgid "Failed managedby"
 msgstr ""
 
-#: ipalib/plugins/host.py:220 ipalib/plugins/service.py:135
+#: ipalib/plugins/host.py:227 ipalib/plugins/service.py:140
 msgid "Users allowed to retrieve keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:223 ipalib/plugins/service.py:138
+#: ipalib/plugins/host.py:230 ipalib/plugins/service.py:143
 msgid "Groups allowed to retrieve keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:226 ipalib/plugins/service.py:141
+#: ipalib/plugins/host.py:233 ipalib/plugins/service.py:146
 msgid "Hosts allowed to retrieve keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:229 ipalib/plugins/service.py:144
+#: ipalib/plugins/host.py:236 ipalib/plugins/service.py:149
 msgid "Host Groups allowed to retrieve keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:232 ipalib/plugins/service.py:147
+#: ipalib/plugins/host.py:239 ipalib/plugins/service.py:152
 msgid "Users allowed to create keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:235 ipalib/plugins/service.py:150
+#: ipalib/plugins/host.py:242 ipalib/plugins/service.py:155
 msgid "Groups allowed to create keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:238 ipalib/plugins/service.py:153
+#: ipalib/plugins/host.py:245 ipalib/plugins/service.py:158
 msgid "Hosts allowed to create keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:241 ipalib/plugins/service.py:156
+#: ipalib/plugins/host.py:248 ipalib/plugins/service.py:161
 msgid "Host Groups allowed to create keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:244 ipalib/plugins/service.py:159
+#: ipalib/plugins/host.py:251 ipalib/plugins/service.py:164
 msgid "Failed allowed to retrieve keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:247 ipalib/plugins/service.py:162
+#: ipalib/plugins/host.py:254 ipalib/plugins/service.py:167
 msgid "Failed allowed to create keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:275
+#: ipalib/plugins/host.py:282
 #, python-format
 msgid "invalid domain-name: %s"
 msgstr ""
 
-#: ipalib/plugins/host.py:286 ipalib/plugins/sudorule.py:424
+#: ipalib/plugins/host.py:293 ipalib/plugins/sudorule.py:428
 msgid "host"
 msgstr ""
 
-#: ipalib/plugins/host.py:287 ipalib/plugins/idviews.py:335
-#: ipalib/plugins/idviews.py:378 ipalib/plugins/sudorule.py:424
+#: ipalib/plugins/host.py:294 ipalib/plugins/idviews.py:367
+#: ipalib/plugins/idviews.py:410 ipalib/plugins/sudorule.py:428
 msgid "hosts"
 msgstr ""
 
-#: ipalib/plugins/host.py:448 ipalib/plugins/internal.py:565
-#: ipalib/plugins/internal.py:634
+#: ipalib/plugins/host.py:455 ipalib/plugins/internal.py:584
+#: ipalib/plugins/internal.py:653
 msgid "Host"
 msgstr ""
 
-#: ipalib/plugins/host.py:453
+#: ipalib/plugins/host.py:460
 msgid "Host name"
 msgstr ""
 
-#: ipalib/plugins/host.py:460
+#: ipalib/plugins/host.py:467
 msgid "A description of this host"
 msgstr ""
 
-#: ipalib/plugins/host.py:464
+#: ipalib/plugins/host.py:471
 msgid "Locality"
 msgstr ""
 
-#: ipalib/plugins/host.py:465
+#: ipalib/plugins/host.py:472
 msgid "Host locality (e.g. \"Baltimore, MD\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:470
+#: ipalib/plugins/host.py:477
 msgid "Host location (e.g. \"Lab 2\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:474
+#: ipalib/plugins/host.py:481
 msgid "Platform"
 msgstr ""
 
-#: ipalib/plugins/host.py:475
+#: ipalib/plugins/host.py:482
 msgid "Host hardware platform (e.g. \"Lenovo T61\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:479
+#: ipalib/plugins/host.py:486
 msgid "Operating system"
 msgstr ""
 
-#: ipalib/plugins/host.py:480
+#: ipalib/plugins/host.py:487
 msgid "Host operating system and version (e.g. \"Fedora 9\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:484
+#: ipalib/plugins/host.py:491
 msgid "User password"
 msgstr ""
 
-#: ipalib/plugins/host.py:485
+#: ipalib/plugins/host.py:492
 msgid "Password used in bulk enrollment"
 msgstr ""
 
-#: ipalib/plugins/host.py:488
+#: ipalib/plugins/host.py:495
 msgid "Generate a random password to be used in bulk enrollment"
 msgstr ""
 
-#: ipalib/plugins/host.py:502 ipalib/plugins/host.py:828
+#: ipalib/plugins/host.py:509 ipalib/plugins/host.py:813
 msgid "Principal name"
 msgstr ""
 
-#: ipalib/plugins/host.py:511
+#: ipalib/plugins/host.py:518
 msgid "MAC address"
 msgstr ""
 
-#: ipalib/plugins/host.py:512
+#: ipalib/plugins/host.py:519
 msgid "Hardware MAC address(es) on this host"
 msgstr ""
 
-#: ipalib/plugins/host.py:524
+#: ipalib/plugins/host.py:531
 msgid ""
 "Host category (semantics placed on this attribute are for local "
 "interpretation)"
 msgstr ""
 
-#: ipalib/plugins/host.py:528 ipalib/plugins/internal.py:547
+#: ipalib/plugins/host.py:535 ipalib/plugins/internal.py:566
 msgid "Assigned ID View"
 msgstr ""
 
-#: ipalib/plugins/host.py:588
+#: ipalib/plugins/host.py:595
 msgid "Add a new host."
 msgstr ""
 
-#: ipalib/plugins/host.py:591
+#: ipalib/plugins/host.py:598
 #, python-format
 msgid "Added host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:596
+#: ipalib/plugins/host.py:603
 msgid "force host name even if not in DNS"
 msgstr ""
 
-#: ipalib/plugins/host.py:599
+#: ipalib/plugins/host.py:606
 msgid "skip reverse DNS detection"
 msgstr ""
 
-#: ipalib/plugins/host.py:602
+#: ipalib/plugins/host.py:609
 msgid "Add the host to DNS with this IP address"
 msgstr ""
 
-#: ipalib/plugins/host.py:687
+#: ipalib/plugins/host.py:694
 #, python-format
 msgid "The host was added but the DNS update failed with: %(exc)s"
 msgstr ""
 
-#: ipalib/plugins/host.py:708
+#: ipalib/plugins/host.py:715
 msgid "Delete a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:710
+#: ipalib/plugins/host.py:717
 #, python-format
 msgid "Deleted host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:715
+#: ipalib/plugins/host.py:722
 msgid "Remove entries from DNS"
 msgstr ""
 
-#: ipalib/plugins/host.py:819
+#: ipalib/plugins/host.py:804
 msgid "Modify information about a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:822
+#: ipalib/plugins/host.py:807
 #, python-format
 msgid "Modified host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:829
+#: ipalib/plugins/host.py:814
 msgid "Kerberos principal name for this host"
 msgstr ""
 
-#: ipalib/plugins/host.py:833
+#: ipalib/plugins/host.py:818
 msgid "Update DNS entries"
 msgstr ""
 
-#: ipalib/plugins/host.py:848
+#: ipalib/plugins/host.py:833
 msgid "Password cannot be set on enrolled host."
 msgstr ""
 
-#: ipalib/plugins/host.py:852
+#: ipalib/plugins/host.py:837
 msgid "cn is immutable"
 msgstr ""
 
-#: ipalib/plugins/host.py:978
+#: ipalib/plugins/host.py:942
 msgid "Search for hosts."
 msgstr ""
 
-#: ipalib/plugins/host.py:982
+#: ipalib/plugins/host.py:946
 #, python-format
 msgid "%(count)d host matched"
 msgid_plural "%(count)d hosts matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/host.py:1065
+#: ipalib/plugins/host.py:1029
 msgid "Display information about a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1070 ipalib/plugins/service.py:709
+#: ipalib/plugins/host.py:1034 ipalib/plugins/service.py:699
+#: ipalib/plugins/user.py:809
 msgid "file to store certificate in"
 msgstr ""
 
-#: ipalib/plugins/host.py:1108 ipalib/plugins/service.py:734
+#: ipalib/plugins/host.py:1072 ipalib/plugins/service.py:724
+#: ipalib/plugins/user.py:833
 #, python-format
 msgid "Certificate(s) stored in file '%(file)s'"
 msgstr ""
 
-#: ipalib/plugins/host.py:1120
+#: ipalib/plugins/host.py:1084
 msgid "Disable the Kerberos key, SSL certificate and all services of a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1123
+#: ipalib/plugins/host.py:1087
 #, python-format
 msgid "Disabled host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:1217
+#: ipalib/plugins/host.py:1159
 msgid "Add hosts that can manage this host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1231 ipalib/plugins/otptoken.py:470
+#: ipalib/plugins/host.py:1173
 msgid "Remove hosts that can manage this host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1244
+#: ipalib/plugins/host.py:1186
 msgid ""
 "Allow users, groups, hosts or host groups to retrieve a keytab of this host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1263
+#: ipalib/plugins/host.py:1205
 msgid ""
 "Disallow users, groups, hosts or host groups to retrieve a keytab of this "
 "host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1281
+#: ipalib/plugins/host.py:1223
 msgid ""
 "Allow users, groups, hosts or host groups to create a keytab of this host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1300
+#: ipalib/plugins/host.py:1242
 msgid ""
 "Disallow users, groups, hosts or host groups to create a keytab of this host."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:30
+#: ipalib/plugins/host.py:1260
+msgid "Add certificates to host entry"
+msgstr ""
+
+#: ipalib/plugins/host.py:1261
+#, python-format
+msgid "Added certificates to host \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/host.py:1267
+msgid "Remove certificates from host entry"
+msgstr ""
+
+#: ipalib/plugins/host.py:1268
+#, python-format
+msgid "Removed certificates from host \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/hostgroup.py:35
 msgid ""
 "\n"
 "Groups of hosts.\n"
@@ -6426,88 +6534,89 @@ msgid ""
 "   ipa hostgroup-del baltimore\n"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:77
+#: ipalib/plugins/hostgroup.py:82
 msgid "host group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:78
+#: ipalib/plugins/hostgroup.py:83
 msgid "host groups"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:142
+#: ipalib/plugins/hostgroup.py:148
 msgid "Host Group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:149
+#: ipalib/plugins/hostgroup.py:155
 msgid "Host-group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:150
+#: ipalib/plugins/hostgroup.py:156
 msgid "Name of host-group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:157
+#: ipalib/plugins/hostgroup.py:163
 msgid "A description of this host-group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:183
+#: ipalib/plugins/hostgroup.py:189
 msgid "Add a new hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:185
+#: ipalib/plugins/hostgroup.py:191
 #, python-format
 msgid "Added hostgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:201
+#: ipalib/plugins/hostgroup.py:207
 #, python-format
 msgid ""
 "netgroup with name \"%s\" already exists. Hostgroups and netgroups share a "
 "common namespace"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:222
+#: ipalib/plugins/hostgroup.py:228
 msgid "Delete a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:224
+#: ipalib/plugins/hostgroup.py:230
 #, python-format
 msgid "Deleted hostgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:229
+#: ipalib/plugins/hostgroup.py:235
 msgid "Modify a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:231
+#: ipalib/plugins/hostgroup.py:237
 #, python-format
 msgid "Modified hostgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:241
+#: ipalib/plugins/hostgroup.py:247
 msgid "Search for hostgroups."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:245
+#: ipalib/plugins/hostgroup.py:251
 #, python-format
 msgid "%(count)d hostgroup matched"
 msgid_plural "%(count)d hostgroups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/hostgroup.py:258
+#: ipalib/plugins/hostgroup.py:264
 msgid "Display information about a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:268
+#: ipalib/plugins/hostgroup.py:274
 msgid "Add members to a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:278
+#: ipalib/plugins/hostgroup.py:284
 msgid "Remove members from a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:34
+#: ipalib/plugins/idrange.py:53
+#, python-brace-format
 msgid ""
 "\n"
 "ID ranges\n"
@@ -6639,103 +6748,91 @@ msgid ""
 "user. RIDs are unique in a domain, 32bit values and are used for users and\n"
 "groups.\n"
 "\n"
-"WARNING:\n"
-"\n"
-"DNA plugin in 389-ds will allocate IDs based on the ranges configured for "
-"the\n"
-"local domain. Currently the DNA plugin *cannot* be reconfigured itself "
-"based\n"
-"on the local ranges set via this family of commands.\n"
-"\n"
-"Manual configuration change has to be done in the DNA plugin configuration "
-"for\n"
-"the new local range. Specifically, The dnaNextRange attribute of 'cn=Posix\n"
-"IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has to "
-"be\n"
-"modified to match the new range.\n"
+"{0}\n"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:185
+#: ipalib/plugins/idrange.py:195
 msgid "ID Ranges"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:186
+#: ipalib/plugins/idrange.py:196
 msgid "ID Range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:190
+#: ipalib/plugins/idrange.py:200
 msgid "local domain range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:192 ipalib/plugins/trust.py:425
+#: ipalib/plugins/idrange.py:202 ipalib/plugins/trust.py:592
 msgid "Active Directory domain range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:193 ipalib/plugins/trust.py:426
+#: ipalib/plugins/idrange.py:203 ipalib/plugins/trust.py:593
 msgid "Active Directory trust range with POSIX attributes"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:201
+#: ipalib/plugins/idrange.py:211
 msgid "Range name"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:206
+#: ipalib/plugins/idrange.py:216
 msgid "First Posix ID of the range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:210
+#: ipalib/plugins/idrange.py:220
 msgid "Number of IDs in the range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:214
+#: ipalib/plugins/idrange.py:224
 msgid "First RID of the corresponding RID range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:218
+#: ipalib/plugins/idrange.py:228
 msgid "First RID of the secondary RID range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:223
+#: ipalib/plugins/idrange.py:233
 msgid "Domain SID of the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:228
+#: ipalib/plugins/idrange.py:238
 msgid "Name of the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:231 ipalib/plugins/internal.py:609
-#: ipalib/plugins/trust.py:459
+#: ipalib/plugins/idrange.py:241 ipalib/plugins/internal.py:628
+#: ipalib/plugins/trust.py:626
 msgid "Range type"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:233
+#: ipalib/plugins/idrange.py:243
 #, python-brace-format
 msgid "ID range type, one of {vals}"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:308
+#: ipalib/plugins/idrange.py:318
 msgid ""
 "range modification leaving objects with ID out of the defined range is not "
 "allowed"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:313
+#: ipalib/plugins/idrange.py:323
 msgid ""
 "Cannot perform SID validation without Samba 4 support installed. Make sure "
 "you have installed server-trust-ad sub-package of IPA on the server"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:320
+#: ipalib/plugins/idrange.py:330
 msgid ""
 "Cross-realm trusts are not configured. Make sure you have run ipa-adtrust-"
 "install on the IPA server first"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:332
+#: ipalib/plugins/idrange.py:342
 msgid "SID is not recognized as a valid SID for a trusted domain"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:369
+#: ipalib/plugins/idrange.py:379
+#, python-brace-format
 msgid ""
 "\n"
 "    Add new ID range.\n"
@@ -6757,120 +6854,115 @@ msgid ""
 "\n"
 "    must be given to add a new range for a trusted AD domain.\n"
 "\n"
-"    WARNING:\n"
-"\n"
-"    DNA plugin in 389-ds will allocate IDs based on the ranges configured "
-"for the\n"
-"    local domain. Currently the DNA plugin *cannot* be reconfigured itself "
-"based\n"
-"    on the local ranges set via this family of commands.\n"
-"\n"
-"    Manual configuration change has to be done in the DNA plugin "
-"configuration for\n"
-"    the new local range. Specifically, The dnaNextRange attribute of "
-"'cn=Posix\n"
-"    IDs,cn=Distributed Numeric Assignment Plugin,cn=plugins,cn=config' has "
-"to be\n"
-"    modified to match the new range.\n"
-"    "
+"{0}\n"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:401
+#: ipalib/plugins/idrange.py:402
 #, python-format
 msgid "Added ID range \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idrange.py:475 ipalib/plugins/idrange.py:702
+#: ipalib/plugins/idrange.py:476 ipalib/plugins/idrange.py:713
 msgid "Options dom-sid and dom-name cannot be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:485 ipalib/plugins/idrange.py:714
+#: ipalib/plugins/idrange.py:486 ipalib/plugins/idrange.py:725
 msgid ""
 "SID for the specified trusted domain name could not be found. Please specify "
 "the SID directly using dom-sid option."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:501
+#: ipalib/plugins/idrange.py:502
 msgid "Options dom-sid/dom-name and rid-base must be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:508 ipalib/plugins/idrange.py:737
+#: ipalib/plugins/idrange.py:509 ipalib/plugins/idrange.py:748
 msgid ""
 "Option rid-base must not be used when IPA range type is ipa-ad-trust-posix"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:515
+#: ipalib/plugins/idrange.py:516
 msgid ""
 "IPA Range type must be one of ipa-ad-trust or ipa-ad-trust-posix when SID of "
 "the trusted domain is specified"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:521
+#: ipalib/plugins/idrange.py:522
 msgid "Options dom-sid/dom-name and secondary-rid-base cannot be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:540
+#: ipalib/plugins/idrange.py:541
 msgid ""
 "IPA Range type must not be one of ipa-ad-trust or ipa-ad-trust-posix when "
 "SID of the trusted domain is not specified."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:547 ipalib/plugins/idrange.py:756
+#: ipalib/plugins/idrange.py:548 ipalib/plugins/idrange.py:767
 msgid "Options secondary-rid-base and rid-base must be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:557 ipalib/plugins/idrange.py:779
+#: ipalib/plugins/idrange.py:558 ipalib/plugins/idrange.py:790
 msgid "Primary RID range and secondary RID range cannot overlap"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:569
+#: ipalib/plugins/idrange.py:570
 msgid ""
 "You must specify both rid-base and secondary-rid-base options, because ipa-"
 "adtrust-install has already been run."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:586
+#: ipalib/plugins/idrange.py:587
 msgid "Delete an ID range."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:588
+#: ipalib/plugins/idrange.py:589
 #, python-format
 msgid "Deleted ID range \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idrange.py:634
+#: ipalib/plugins/idrange.py:635
 msgid "Search for ranges."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:637
+#: ipalib/plugins/idrange.py:638
 #, python-format
 msgid "%(count)d range matched"
 msgid_plural "%(count)d ranges matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/idrange.py:657
+#: ipalib/plugins/idrange.py:658
 msgid "Display information about a range."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:673
-msgid "Modify ID range."
+#: ipalib/plugins/idrange.py:674
+#, python-brace-format
+msgid ""
+"Modify ID range.\n"
+"\n"
+"{0}\n"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:675
+#: ipalib/plugins/idrange.py:679
 #, python-format
 msgid "Modified ID range \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idrange.py:721
+#: ipalib/plugins/idrange.py:697
+msgid ""
+"This command can not be used to change ID allocation for local IPA domain. "
+"Run `ipa help idrange` for more information"
+msgstr ""
+
+#: ipalib/plugins/idrange.py:732
 msgid "Options dom-sid and secondary-rid-base cannot be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:728
+#: ipalib/plugins/idrange.py:739
 msgid "Options dom-sid and rid-base must be used together"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:40
+#: ipalib/plugins/idviews.py:48
 msgid ""
 "\n"
 "ID Views\n"
@@ -6882,905 +6974,943 @@ msgid ""
 "other Identity Management solutions.\n"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:51 ipalib/plugins/idviews.py:65
-#: ipalib/plugins/idviews.py:72 ipalib/plugins/idviews.py:248
-#: ipalib/plugins/idviews.py:593
+#: ipalib/plugins/idviews.py:59 ipalib/plugins/idviews.py:88
+#: ipalib/plugins/idviews.py:95 ipalib/plugins/idviews.py:275
+#: ipalib/plugins/idviews.py:712
 msgid "ID View"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:53
+#: ipalib/plugins/idviews.py:61
 msgid "system ID View"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:66 ipalib/plugins/idviews.py:71
+#: ipalib/plugins/idviews.py:67
+msgid "Fallback to AD DC LDAP"
+msgstr ""
+
+#: ipalib/plugins/idviews.py:68
+msgid ""
+"Allow falling back to AD DC LDAP when resolving AD trusted objects. For two-"
+"way trusts only."
+msgstr ""
+
+#: ipalib/plugins/idviews.py:89 ipalib/plugins/idviews.py:94
 msgid "ID Views"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:77
+#: ipalib/plugins/idviews.py:100
 msgid "ID View Name"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:100
+#: ipalib/plugins/idviews.py:123
 msgid "Add a new ID View."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:101
+#: ipalib/plugins/idviews.py:124
 #, python-format
 msgid "Added ID View \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:106
+#: ipalib/plugins/idviews.py:129
 msgid "Delete an ID View."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:107
+#: ipalib/plugins/idviews.py:130
 #, python-format
 msgid "Deleted ID View \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:119
+#: ipalib/plugins/idviews.py:142
 msgid "Modify an ID View."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:120
+#: ipalib/plugins/idviews.py:143
 #, python-format
 msgid "Modified an ID View \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:132
+#: ipalib/plugins/idviews.py:155
 msgid "Search for an ID View."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:133
+#: ipalib/plugins/idviews.py:156
 #, python-format
 msgid "%(count)d ID View matched"
 msgid_plural "%(count)d ID Views matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/idviews.py:139
+#: ipalib/plugins/idviews.py:162
 msgid "Display information about an ID View."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:144
+#: ipalib/plugins/idviews.py:167
 msgid "Enumerate all the hosts the view applies to."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:150
+#: ipalib/plugins/idviews.py:173
 msgid "User object overrides"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:153
+#: ipalib/plugins/idviews.py:176
 msgid "Group object overrides"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:156
+#: ipalib/plugins/idviews.py:179
 msgid "Hosts the view applies to"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:249
+#: ipalib/plugins/idviews.py:276
 msgid "Default Trust View cannot be applied on hosts"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:272 ipalib/plugins/idviews.py:295
+#: ipalib/plugins/idviews.py:304 ipalib/plugins/idviews.py:327
 msgid "not found"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:293
+#: ipalib/plugins/idviews.py:325
 msgid "ID View already applied"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:313
+#: ipalib/plugins/idviews.py:345
 msgid "value"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:322
+#: ipalib/plugins/idviews.py:354
 msgid ""
 "Applies ID View to specified hosts or current members of specified "
-"hostgroups. If any other ID View is applied to the host, it is overriden."
+"hostgroups. If any other ID View is applied to the host, it is overridden."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:326
+#: ipalib/plugins/idviews.py:358
 #, python-format
 msgid "ID View applied to %i host."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:327
+#: ipalib/plugins/idviews.py:359
 #, python-format
 msgid "ID View applied to %i hosts."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:334
+#: ipalib/plugins/idviews.py:366
 msgid "Hosts to apply the ID View to"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:339
+#: ipalib/plugins/idviews.py:371
 msgid ""
 "Hostgroups to whose hosts apply the ID View to. Please note that view is not "
 "applied automatically to any hosts added to the hostgroup after running the "
 "idview-apply command."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:342 ipalib/plugins/idviews.py:385
+#: ipalib/plugins/idviews.py:374 ipalib/plugins/idviews.py:417
 msgid "hostgroups"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:350
+#: ipalib/plugins/idviews.py:382
 msgid "Hosts that this ID View was applied to."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:354
+#: ipalib/plugins/idviews.py:386
 msgid "Hosts or hostgroups that this ID View could not be applied to."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:359
+#: ipalib/plugins/idviews.py:391
 msgid "Number of hosts the ID View was applied to:"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:366
+#: ipalib/plugins/idviews.py:398
 msgid ""
 "Clears ID View from specified hosts or current members of specified "
 "hostgroups."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:369
+#: ipalib/plugins/idviews.py:401
 #, python-format
 msgid "ID View cleared from %i host."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:370
+#: ipalib/plugins/idviews.py:402
 #, python-format
 msgid "ID View cleared from %i hosts."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:377
+#: ipalib/plugins/idviews.py:409
 msgid "Hosts to clear (any) ID View from."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:382
+#: ipalib/plugins/idviews.py:414
 msgid ""
 "Hostgroups whose hosts should have ID Views cleared. Note that view is not "
 "cleared automatically from any host added to the hostgroup after running "
 "idview-unapply command."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:393
+#: ipalib/plugins/idviews.py:425
 msgid "Hosts that ID View was cleared from."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:397
+#: ipalib/plugins/idviews.py:429
 msgid "Hosts or hostgroups that ID View could not be cleared from."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:402
+#: ipalib/plugins/idviews.py:434
 msgid "Number of hosts that had a ID View was unset:"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:445
+#: ipalib/plugins/idviews.py:470
+msgid ""
+"You are trying to reference a magic private group which is not allowed to be "
+"overriden. Try overriding the GID attribute of the corresponding user "
+"instead."
+msgstr ""
+
+#: ipalib/plugins/idviews.py:507
 msgid "IPA object"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:446
+#: ipalib/plugins/idviews.py:508
 msgid ""
 "system IPA objects (e.g system groups, user private groups) cannot be "
-"overriden"
+"overridden"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:527
+#: ipalib/plugins/idviews.py:602
 #, python-format
 msgid "Anchor '%(anchor)s' could not be resolved."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:549
+#: ipalib/plugins/idviews.py:649
 msgid "Anchor to override"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:594
+#: ipalib/plugins/idviews.py:713
 msgid "Default Trust View cannot contain IPA users"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:598
+#: ipalib/plugins/idviews.py:717
 msgid "Add a new ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:599
+#: ipalib/plugins/idviews.py:718
 #, python-format
 msgid "Added ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:612
+#: ipalib/plugins/idviews.py:733
 msgid "Delete an ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:613
+#: ipalib/plugins/idviews.py:734
 #, python-format
 msgid "Deleted ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:617
+#: ipalib/plugins/idviews.py:759
 msgid "Modify an ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:618
+#: ipalib/plugins/idviews.py:760
 #, python-format
 msgid "Modified an ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:623
+#: ipalib/plugins/idviews.py:767
 msgid "ID override"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:624
+#: ipalib/plugins/idviews.py:768
 msgid "ID overrides cannot be renamed"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:636
+#: ipalib/plugins/idviews.py:780
 msgid "Search for an ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:637
+#: ipalib/plugins/idviews.py:781
 #, python-format
 msgid "%(count)d ID override matched"
 msgid_plural "%(count)d ID overrides matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/idviews.py:647
+#: ipalib/plugins/idviews.py:793
 msgid "Display information about an ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:657 ipalib/plugins/idviews.py:661
+#: ipalib/plugins/idviews.py:805 ipalib/plugins/idviews.py:809
 msgid "User ID override"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:658 ipalib/plugins/idviews.py:660
+#: ipalib/plugins/idviews.py:806 ipalib/plugins/idviews.py:808
 msgid "User ID overrides"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:696
+#: ipalib/plugins/idviews.py:844
 msgid "User ID Number"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:740 ipalib/plugins/idviews.py:744
+#: ipalib/plugins/idviews.py:895 ipalib/plugins/idviews.py:899
 msgid "Group ID override"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:741 ipalib/plugins/idviews.py:743
+#: ipalib/plugins/idviews.py:896 ipalib/plugins/idviews.py:898
 msgid "Group ID overrides"
 msgstr ""
 
-#: ipalib/plugins/idviews.py:786
+#: ipalib/plugins/idviews.py:941
 msgid "Add a new User ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:787
+#: ipalib/plugins/idviews.py:942
 #, python-format
 msgid "Added User ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:809
+#: ipalib/plugins/idviews.py:964
 msgid "Delete an User ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:810
+#: ipalib/plugins/idviews.py:965
 #, python-format
 msgid "Deleted User ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:815
+#: ipalib/plugins/idviews.py:970
 msgid "Modify an User ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:816
+#: ipalib/plugins/idviews.py:971
 #, python-format
 msgid "Modified an User ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:844
+#: ipalib/plugins/idviews.py:999
 msgid "Search for an User ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:845
+#: ipalib/plugins/idviews.py:1000
 #, python-format
 msgid "%(count)d User ID override matched"
 msgid_plural "%(count)d User ID overrides matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/idviews.py:858
+#: ipalib/plugins/idviews.py:1013
 msgid "Display information about an User ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:869
+#: ipalib/plugins/idviews.py:1024
 msgid "Add a new Group ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:870
+#: ipalib/plugins/idviews.py:1025
 #, python-format
 msgid "Added Group ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:875
+#: ipalib/plugins/idviews.py:1030
 msgid "Delete an Group ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:876
+#: ipalib/plugins/idviews.py:1031
 #, python-format
 msgid "Deleted Group ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:881
+#: ipalib/plugins/idviews.py:1036
 msgid "Modify an Group ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:882
+#: ipalib/plugins/idviews.py:1037
 #, python-format
 msgid "Modified an Group ID override \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idviews.py:887
+#: ipalib/plugins/idviews.py:1042
 msgid "Search for an Group ID override."
 msgstr ""
 
-#: ipalib/plugins/idviews.py:888
+#: ipalib/plugins/idviews.py:1043
 #, python-format
 msgid "%(count)d Group ID override matched"
 msgid_plural "%(count)d Group ID overrides matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/idviews.py:894
+#: ipalib/plugins/idviews.py:1049
 msgid "Display information about an Group ID override."
 msgstr ""
 
-#: ipalib/plugins/internal.py:48 ipalib/plugins/internal.py:57
+#: ipalib/plugins/internal.py:49 ipalib/plugins/internal.py:58
 msgid "Name of object to export"
 msgstr ""
 
-#: ipalib/plugins/internal.py:51 ipalib/plugins/internal.py:60
+#: ipalib/plugins/internal.py:52 ipalib/plugins/internal.py:61
 msgid "Name of method to export"
 msgstr ""
 
-#: ipalib/plugins/internal.py:63
+#: ipalib/plugins/internal.py:64
 msgid "Name of command to export"
 msgstr ""
 
-#: ipalib/plugins/internal.py:68
+#: ipalib/plugins/internal.py:69
 msgid "Dict of JSON encoded IPA Objects"
 msgstr ""
 
-#: ipalib/plugins/internal.py:69
+#: ipalib/plugins/internal.py:70
 msgid "Dict of JSON encoded IPA Methods"
 msgstr ""
 
-#: ipalib/plugins/internal.py:70
+#: ipalib/plugins/internal.py:71
 msgid "Dict of JSON encoded IPA Commands"
 msgstr ""
 
-#: ipalib/plugins/internal.py:151
+#: ipalib/plugins/internal.py:152
 msgid "Your session has expired. Please re-login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:155 ipalib/plugins/internal.py:209
+#: ipalib/plugins/internal.py:156 ipalib/plugins/internal.py:210
 msgid "Apply"
 msgstr ""
 
-#: ipalib/plugins/internal.py:156
+#: ipalib/plugins/internal.py:157
 msgid "Rebuild auto membership"
 msgstr ""
 
-#: ipalib/plugins/internal.py:157
+#: ipalib/plugins/internal.py:158
 msgid "Are you sure you want to rebuild auto membership?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:159
+#: ipalib/plugins/internal.py:160
 msgid "Are you sure you want to proceed with the action?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:160
+#: ipalib/plugins/internal.py:161
 #, python-brace-format
 msgid "Are you sure you want to delete ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:161
+#: ipalib/plugins/internal.py:162
 #, python-brace-format
 msgid "Are you sure you want to disable ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:162
+#: ipalib/plugins/internal.py:163
 #, python-brace-format
 msgid "Are you sure you want to enable ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:163
+#: ipalib/plugins/internal.py:164
 msgid "Actions"
 msgstr ""
 
-#: ipalib/plugins/internal.py:167
+#: ipalib/plugins/internal.py:168
 #, python-brace-format
 msgid "Add RunAs ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:168
+#: ipalib/plugins/internal.py:169
 #, python-brace-format
 msgid "Add RunAs Groups into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:169
+#: ipalib/plugins/internal.py:170
 #, python-brace-format
 msgid "Add ${other_entity} Managing ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:170
+#: ipalib/plugins/internal.py:171
 #, python-brace-format
 msgid "Add ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:171
+#: ipalib/plugins/internal.py:172
 #, python-brace-format
 msgid "Add Allow ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:172
+#: ipalib/plugins/internal.py:173
 #, python-brace-format
 msgid "Add Deny ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:173
+#: ipalib/plugins/internal.py:174
 #, python-brace-format
 msgid "Add ${entity} ${primary_key} into ${other_entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:175
+#: ipalib/plugins/internal.py:176
 #, python-brace-format
 msgid "${count} item(s) added"
 msgstr ""
 
-#: ipalib/plugins/internal.py:176
+#: ipalib/plugins/internal.py:177
 msgid "Direct Membership"
 msgstr ""
 
-#: ipalib/plugins/internal.py:177
+#: ipalib/plugins/internal.py:178
 #, python-brace-format
 msgid "Filter available ${other_entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:178
+#: ipalib/plugins/internal.py:179
 msgid "Indirect Membership"
 msgstr ""
 
-#: ipalib/plugins/internal.py:179
+#: ipalib/plugins/internal.py:180
 msgid "No entries."
 msgstr ""
 
-#: ipalib/plugins/internal.py:180
+#: ipalib/plugins/internal.py:181
 #, python-brace-format
 msgid "Showing ${start} to ${end} of ${total} entries."
 msgstr ""
 
-#: ipalib/plugins/internal.py:182
+#: ipalib/plugins/internal.py:183
 #, python-brace-format
 msgid "Remove RunAs ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:183
+#: ipalib/plugins/internal.py:184
 #, python-brace-format
 msgid "Remove RunAs Groups from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:184
+#: ipalib/plugins/internal.py:185
 #, python-brace-format
 msgid "Remove ${other_entity} Managing ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:185
+#: ipalib/plugins/internal.py:186
 #, python-brace-format
 msgid "Remove ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:186
+#: ipalib/plugins/internal.py:187
 #, python-brace-format
 msgid "Remove Allow ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:187
+#: ipalib/plugins/internal.py:188
 #, python-brace-format
 msgid "Remove Deny ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:188
+#: ipalib/plugins/internal.py:189
 #, python-brace-format
 msgid "Remove ${entity} ${primary_key} from ${other_entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:190
+#: ipalib/plugins/internal.py:191
 #, python-brace-format
 msgid "${count} item(s) removed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:191
+#: ipalib/plugins/internal.py:192
 msgid "Show Results"
 msgstr ""
 
-#: ipalib/plugins/internal.py:194
-msgid "Implicit method (password) will be used if no method is chosen."
+#: ipalib/plugins/internal.py:195
+msgid ""
+"<p>Implicit method (password) will be used if no method is chosen.</"
+"p><p><strong>Password + Two-factor:</strong> LDAP and Kerberos allow "
+"authentication with either one of the authentication types but Kerberos uses "
+"pre-authentication method which requires to use armor ccache.</"
+"p><p><strong>RADIUS with another type:</strong> Kerberos always use RADIUS, "
+"but LDAP never does. LDAP only recognize the password and two-factor "
+"authentication options.</p>"
 msgstr ""
 
-#: ipalib/plugins/internal.py:195
+#: ipalib/plugins/internal.py:196
 msgid "Two factor authentication (password + OTP)"
 msgstr ""
 
-#: ipalib/plugins/internal.py:197
+#: ipalib/plugins/internal.py:198
 msgid "Radius"
 msgstr ""
 
-#: ipalib/plugins/internal.py:198
+#: ipalib/plugins/internal.py:199
 msgid "Disable per-user override"
 msgstr ""
 
-#: ipalib/plugins/internal.py:199
+#: ipalib/plugins/internal.py:200
 msgid ""
-"Per-user setting, overwrites the global setting if any option is checked."
+"<p>Per-user setting, overwrites the global setting if any option is checked."
+"</p><p><strong>Password + Two-factor:</strong> LDAP and Kerberos allow "
+"authentication with either one of the authentication types but Kerberos uses "
+"pre-authentication method which requires to use armor ccache.</"
+"p><p><strong>RADIUS with another type:</strong> Kerberos always use RADIUS, "
+"but LDAP never does. LDAP only recognize the password and two-factor "
+"authentication options.</p>"
 msgstr ""
 
-#: ipalib/plugins/internal.py:202 ipalib/plugins/internal.py:255
+#: ipalib/plugins/internal.py:203 ipalib/plugins/internal.py:258
 msgid "About"
 msgstr ""
 
-#: ipalib/plugins/internal.py:203
+#: ipalib/plugins/internal.py:204
 msgid "Activate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:204
+#: ipalib/plugins/internal.py:205
 msgid "Add"
 msgstr ""
 
-#: ipalib/plugins/internal.py:205
+#: ipalib/plugins/internal.py:206
 msgid "Add and Add Another"
 msgstr ""
 
-#: ipalib/plugins/internal.py:206
+#: ipalib/plugins/internal.py:207
 msgid "Add and Close"
 msgstr ""
 
-#: ipalib/plugins/internal.py:207
+#: ipalib/plugins/internal.py:208
 msgid "Add and Edit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:208
+#: ipalib/plugins/internal.py:209
 msgid "Add Many"
 msgstr ""
 
-#: ipalib/plugins/internal.py:210
+#: ipalib/plugins/internal.py:211
 msgid "Back"
 msgstr ""
 
-#: ipalib/plugins/internal.py:211
+#: ipalib/plugins/internal.py:212
 msgid "Cancel"
 msgstr ""
 
-#: ipalib/plugins/internal.py:212
+#: ipalib/plugins/internal.py:213
 msgid "Close"
 msgstr ""
 
-#: ipalib/plugins/internal.py:213 ipalib/plugins/internal.py:782
+#: ipalib/plugins/internal.py:214 ipalib/plugins/internal.py:802
 msgid "Disable"
 msgstr ""
 
-#: ipalib/plugins/internal.py:214
+#: ipalib/plugins/internal.py:215
 msgid "Edit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:215 ipalib/plugins/internal.py:784
+#: ipalib/plugins/internal.py:216 ipalib/plugins/internal.py:804
 msgid "Enable"
 msgstr ""
 
-#: ipalib/plugins/internal.py:217
+#: ipalib/plugins/internal.py:218
 msgid "Find"
 msgstr ""
 
-#: ipalib/plugins/internal.py:218
+#: ipalib/plugins/internal.py:219
 msgid "Get"
 msgstr ""
 
-#: ipalib/plugins/internal.py:219
+#: ipalib/plugins/internal.py:220
+msgid "Hide"
+msgstr ""
+
+#: ipalib/plugins/internal.py:221
 msgid "Issue"
 msgstr ""
 
-#: ipalib/plugins/internal.py:220
+#: ipalib/plugins/internal.py:222
 msgid "OK"
 msgstr ""
 
-#: ipalib/plugins/internal.py:221
+#: ipalib/plugins/internal.py:223
 msgid "Refresh"
 msgstr ""
 
-#: ipalib/plugins/internal.py:222
+#: ipalib/plugins/internal.py:224
 msgid "Delete"
 msgstr ""
 
-#: ipalib/plugins/internal.py:223
+#: ipalib/plugins/internal.py:225
 msgid "Reset"
 msgstr ""
 
-#: ipalib/plugins/internal.py:224
+#: ipalib/plugins/internal.py:226
 msgid "Reset Password and Login"
 msgstr ""
 
-#: ipalib/plugins/internal.py:225
+#: ipalib/plugins/internal.py:227
 msgid "Restore"
 msgstr ""
 
-#: ipalib/plugins/internal.py:226
+#: ipalib/plugins/internal.py:228
 msgid "Retry"
 msgstr ""
 
-#: ipalib/plugins/internal.py:227
+#: ipalib/plugins/internal.py:229
 msgid "Revert"
 msgstr ""
 
-#: ipalib/plugins/internal.py:228
+#: ipalib/plugins/internal.py:230
 msgid "Revoke"
 msgstr ""
 
-#: ipalib/plugins/internal.py:229
+#: ipalib/plugins/internal.py:231
 msgid "Save"
 msgstr ""
 
-#: ipalib/plugins/internal.py:230
+#: ipalib/plugins/internal.py:232
 msgid "Set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:232
+#: ipalib/plugins/internal.py:233
+msgid "Show"
+msgstr ""
+
+#: ipalib/plugins/internal.py:235
 msgid "Update"
 msgstr ""
 
-#: ipalib/plugins/internal.py:233
+#: ipalib/plugins/internal.py:236
 msgid "View"
 msgstr ""
 
-#: ipalib/plugins/internal.py:236
+#: ipalib/plugins/internal.py:239
 msgid "Collapse All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:237
+#: ipalib/plugins/internal.py:240
 msgid "Expand All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:238
+#: ipalib/plugins/internal.py:241
 msgid "General"
 msgstr ""
 
-#: ipalib/plugins/internal.py:239
+#: ipalib/plugins/internal.py:242
 msgid "Identity Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:240
+#: ipalib/plugins/internal.py:243
 #, python-brace-format
 msgid "${entity} ${primary_key} Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:241
+#: ipalib/plugins/internal.py:244
 msgid "Back to Top"
 msgstr ""
 
-#: ipalib/plugins/internal.py:242
+#: ipalib/plugins/internal.py:245
 #, python-brace-format
 msgid "${entity} ${primary_key} updated"
 msgstr ""
 
-#: ipalib/plugins/internal.py:245
+#: ipalib/plugins/internal.py:248
 #, python-brace-format
 msgid "${entity} successfully added"
 msgstr ""
 
-#: ipalib/plugins/internal.py:246
+#: ipalib/plugins/internal.py:249
 #, python-brace-format
 msgid "Add ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:247
+#: ipalib/plugins/internal.py:250
 msgid "Available"
 msgstr ""
 
-#: ipalib/plugins/internal.py:248
+#: ipalib/plugins/internal.py:251
 msgid "Some operations failed."
 msgstr ""
 
-#: ipalib/plugins/internal.py:249
+#: ipalib/plugins/internal.py:252
 msgid "Operations Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:250
+#: ipalib/plugins/internal.py:253
 msgid "Confirmation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:251
+#: ipalib/plugins/internal.py:254
 msgid "This page has unsaved changes. Please save or revert."
 msgstr ""
 
-#: ipalib/plugins/internal.py:252
+#: ipalib/plugins/internal.py:255
 msgid "Unsaved Changes"
 msgstr ""
 
-#: ipalib/plugins/internal.py:253
+#: ipalib/plugins/internal.py:256
 #, python-brace-format
 msgid "Edit ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:254
+#: ipalib/plugins/internal.py:257
 msgid "Hide details"
 msgstr ""
 
-#: ipalib/plugins/internal.py:256
+#: ipalib/plugins/internal.py:259
 #, python-brace-format
 msgid "${product}, version: ${version}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:257
+#: ipalib/plugins/internal.py:260
 msgid "Prospective"
 msgstr ""
 
-#: ipalib/plugins/internal.py:258
+#: ipalib/plugins/internal.py:261
 msgid "Redirection"
 msgstr ""
 
-#: ipalib/plugins/internal.py:259
+#: ipalib/plugins/internal.py:262
 msgid "Select entries to be removed."
 msgstr ""
 
-#: ipalib/plugins/internal.py:260
+#: ipalib/plugins/internal.py:263
 #, python-brace-format
 msgid "Remove ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:261
+#: ipalib/plugins/internal.py:264
 msgid "Show details"
 msgstr ""
 
-#: ipalib/plugins/internal.py:262
+#: ipalib/plugins/internal.py:265
 msgid "Success"
 msgstr ""
 
-#: ipalib/plugins/internal.py:263
+#: ipalib/plugins/internal.py:266
 msgid "Validation error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:264
+#: ipalib/plugins/internal.py:267
 msgid "Input form contains invalid or missing values."
 msgstr ""
 
-#: ipalib/plugins/internal.py:267
+#: ipalib/plugins/internal.py:270
 msgid "Please try the following options:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:268
+#: ipalib/plugins/internal.py:271
 msgid "If the problem persists please contact the system administrator."
 msgstr ""
 
-#: ipalib/plugins/internal.py:269
+#: ipalib/plugins/internal.py:272
 msgid "Refresh the page."
 msgstr ""
 
-#: ipalib/plugins/internal.py:270
+#: ipalib/plugins/internal.py:273
 msgid "Reload the browser."
 msgstr ""
 
-#: ipalib/plugins/internal.py:271
+#: ipalib/plugins/internal.py:274
 msgid "Return to the main page and retry the operation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:272
+#: ipalib/plugins/internal.py:275
 #, python-brace-format
 msgid "An error has occurred (${error})"
 msgstr ""
 
-#: ipalib/plugins/internal.py:276
+#: ipalib/plugins/internal.py:279
 msgid "HTTP Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:277
+#: ipalib/plugins/internal.py:280
 msgid "Internal Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:278
+#: ipalib/plugins/internal.py:281
 msgid "IPA Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:279
+#: ipalib/plugins/internal.py:282
 msgid "No response"
 msgstr ""
 
-#: ipalib/plugins/internal.py:280
+#: ipalib/plugins/internal.py:283
 msgid "Unknown Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:281
+#: ipalib/plugins/internal.py:284
 msgid "URL"
 msgstr ""
 
-#: ipalib/plugins/internal.py:284
+#: ipalib/plugins/internal.py:287
 #, python-brace-format
 msgid "${primary_key} is managed by:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:285
+#: ipalib/plugins/internal.py:288
 #, python-brace-format
 msgid "${primary_key} members:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:286
+#: ipalib/plugins/internal.py:289
 #, python-brace-format
 msgid "${primary_key} is a member of:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:289
+#: ipalib/plugins/internal.py:292
 msgid "Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:290 ipalib/plugins/internal.py:775
+#: ipalib/plugins/internal.py:293 ipalib/plugins/internal.py:795
 msgid "Search"
 msgstr ""
 
-#: ipalib/plugins/internal.py:292
+#: ipalib/plugins/internal.py:295
 msgid "False"
 msgstr ""
 
-#: ipalib/plugins/internal.py:294
+#: ipalib/plugins/internal.py:297
 #, python-brace-format
 msgid "Allow ${other_entity} to create keytab of ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:295
+#: ipalib/plugins/internal.py:298
 #, python-brace-format
 msgid "Allow ${other_entity} to retrieve keytab of ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:296
+#: ipalib/plugins/internal.py:299
 msgid "Allowed to create keytab"
 msgstr ""
 
-#: ipalib/plugins/internal.py:297
+#: ipalib/plugins/internal.py:300
 msgid "Allowed to retrieve keytab"
 msgstr ""
 
-#: ipalib/plugins/internal.py:298
+#: ipalib/plugins/internal.py:301
 #, python-brace-format
 msgid "Disallow ${other_entity} to create keytab of ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:299
+#: ipalib/plugins/internal.py:302
 #, python-brace-format
 msgid "Disallow ${other_entity} to retrieve keytab of ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:302
+#: ipalib/plugins/internal.py:305
 msgid "Inherited from server configuration"
 msgstr ""
 
-#: ipalib/plugins/internal.py:303
+#: ipalib/plugins/internal.py:306
 msgid "MS-PAC"
 msgstr ""
 
-#: ipalib/plugins/internal.py:304
+#: ipalib/plugins/internal.py:307
 msgid "Override inherited settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:305
+#: ipalib/plugins/internal.py:308
 msgid "PAD"
 msgstr ""
 
-#: ipalib/plugins/internal.py:308
+#: ipalib/plugins/internal.py:311
 msgid ""
 "<i class=\"fa fa-info-circle\"></i> To login with <strong>username and "
 "password</strong>, enter them in the corresponding fields, then click Login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:309
+#: ipalib/plugins/internal.py:312
 msgid "Logged In As"
 msgstr ""
 
-#: ipalib/plugins/internal.py:310
+#: ipalib/plugins/internal.py:313
 #, python-brace-format
 msgid ""
 "<i class=\"fa fa-info-circle\"></i> To login with <strong>Kerberos</strong>, "
@@ -7789,1500 +7919,1535 @@ msgid ""
 "browser correctly, then click Login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:311
+#: ipalib/plugins/internal.py:314
 msgid "Login"
 msgstr ""
 
-#: ipalib/plugins/internal.py:312
+#: ipalib/plugins/internal.py:315
 msgid "Logout"
 msgstr ""
 
-#: ipalib/plugins/internal.py:313
+#: ipalib/plugins/internal.py:316
 msgid "Logout error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:315
+#: ipalib/plugins/internal.py:318
 msgid "Sync OTP Token"
 msgstr ""
 
-#: ipalib/plugins/internal.py:316 ipalib/plugins/vault.py:157
+#: ipalib/plugins/internal.py:319
 msgid "Username"
 msgstr ""
 
-#: ipalib/plugins/internal.py:319
+#: ipalib/plugins/internal.py:322
 msgid "number of passwords"
 msgstr ""
 
-#: ipalib/plugins/internal.py:320
+#: ipalib/plugins/internal.py:323
 msgid "seconds"
 msgstr ""
 
-#: ipalib/plugins/internal.py:324 ipalib/plugins/internal.py:329
-#: ipalib/plugins/internal.py:590
+#: ipalib/plugins/internal.py:327 ipalib/plugins/internal.py:332
+#: ipalib/plugins/internal.py:609
 msgid "Attribute"
 msgstr ""
 
-#: ipalib/plugins/internal.py:327
+#: ipalib/plugins/internal.py:330
 #, python-brace-format
 msgid "Add Condition into ${pkey}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:328
+#: ipalib/plugins/internal.py:331
 msgid "Add Rule"
 msgstr ""
 
-#: ipalib/plugins/internal.py:330
+#: ipalib/plugins/internal.py:333
 msgid "Default host group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:331
+#: ipalib/plugins/internal.py:334
 msgid "Default user group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:332
+#: ipalib/plugins/internal.py:335
 msgid "Exclusive"
 msgstr ""
 
-#: ipalib/plugins/internal.py:333
+#: ipalib/plugins/internal.py:336
 msgid "Expression"
 msgstr ""
 
-#: ipalib/plugins/internal.py:334
+#: ipalib/plugins/internal.py:337
 msgid "Host group rule"
 msgstr ""
 
-#: ipalib/plugins/internal.py:335
+#: ipalib/plugins/internal.py:338
 msgid "Host group rules"
 msgstr ""
 
-#: ipalib/plugins/internal.py:336
+#: ipalib/plugins/internal.py:339
 msgid "Inclusive"
 msgstr ""
 
-#: ipalib/plugins/internal.py:337
+#: ipalib/plugins/internal.py:340
 msgid "User group rule"
 msgstr ""
 
-#: ipalib/plugins/internal.py:338
+#: ipalib/plugins/internal.py:341
 msgid "User group rules"
 msgstr ""
 
-#: ipalib/plugins/internal.py:343
+#: ipalib/plugins/internal.py:346
 msgid "Automount Location Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:346
+#: ipalib/plugins/internal.py:349
 msgid "Map Type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:347
+#: ipalib/plugins/internal.py:350
 msgid "Direct"
 msgstr ""
 
-#: ipalib/plugins/internal.py:348
+#: ipalib/plugins/internal.py:351
 msgid "Indirect"
 msgstr ""
 
-#: ipalib/plugins/internal.py:351
+#: ipalib/plugins/internal.py:354 ipalib/plugins/internal.py:490
+#: ipalib/plugins/internal.py:581 ipalib/plugins/internal.py:651
+#: ipalib/plugins/internal.py:702
+msgid "Any Host"
+msgstr ""
+
+#: ipalib/plugins/internal.py:355 ipalib/plugins/internal.py:491
+msgid "Any Service"
+msgstr ""
+
+#: ipalib/plugins/internal.py:356
+msgid "Any Profile"
+msgstr ""
+
+#: ipalib/plugins/internal.py:357 ipalib/plugins/internal.py:492
+#: ipalib/plugins/internal.py:582 ipalib/plugins/internal.py:652
+#: ipalib/plugins/internal.py:703
+msgid "Anyone"
+msgstr ""
+
+#: ipalib/plugins/internal.py:358 ipalib/plugins/internal.py:494
+#: ipalib/plugins/internal.py:708
+msgid "Rule status"
+msgstr ""
+
+#: ipalib/plugins/internal.py:360 ipalib/plugins/internal.py:496
+#: ipalib/plugins/internal.py:588 ipalib/plugins/internal.py:654
+#: ipalib/plugins/internal.py:715
+msgid "Specified Hosts and Groups"
+msgstr ""
+
+#: ipalib/plugins/internal.py:361
+msgid "Specified Profiles"
+msgstr ""
+
+#: ipalib/plugins/internal.py:362 ipalib/plugins/internal.py:497
+msgid "Specified Services and Groups"
+msgstr ""
+
+#: ipalib/plugins/internal.py:363 ipalib/plugins/internal.py:498
+#: ipalib/plugins/internal.py:589 ipalib/plugins/internal.py:655
+#: ipalib/plugins/internal.py:716
+msgid "Specified Users and Groups"
+msgstr ""
+
+#: ipalib/plugins/internal.py:364
+msgid "Permitted to have certificates issued"
+msgstr ""
+
+#: ipalib/plugins/internal.py:367
 msgid "AA Compromise"
 msgstr ""
 
-#: ipalib/plugins/internal.py:352
+#: ipalib/plugins/internal.py:368
+msgid "Add principal"
+msgstr ""
+
+#: ipalib/plugins/internal.py:369
 msgid "Affiliation Changed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:353
+#: ipalib/plugins/internal.py:370
 msgid "CA Compromise"
 msgstr ""
 
-#: ipalib/plugins/internal.py:355 ipalib/plugins/internal.py:794
+#: ipalib/plugins/internal.py:372 ipalib/plugins/internal.py:814
 msgid "Certificates"
 msgstr ""
 
-#: ipalib/plugins/internal.py:356
+#: ipalib/plugins/internal.py:373
 msgid "Certificate Hold"
 msgstr ""
 
-#: ipalib/plugins/internal.py:357
+#: ipalib/plugins/internal.py:374
 msgid "Cessation of Operation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:358
+#: ipalib/plugins/internal.py:375
 msgid "Common Name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:359
+#: ipalib/plugins/internal.py:376
 msgid "Expires On"
 msgstr ""
 
-#: ipalib/plugins/internal.py:360
+#: ipalib/plugins/internal.py:377
 msgid "Issued on from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:361
+#: ipalib/plugins/internal.py:378
 msgid "Issued on to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:362
+#: ipalib/plugins/internal.py:379
 msgid "Maximum serial number"
 msgstr ""
 
-#: ipalib/plugins/internal.py:363
+#: ipalib/plugins/internal.py:380
 msgid "Minimum serial number"
 msgstr ""
 
-#: ipalib/plugins/internal.py:365
+#: ipalib/plugins/internal.py:382
 msgid "Revoked on from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:366
+#: ipalib/plugins/internal.py:383
 msgid "Revoked on to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:368
+#: ipalib/plugins/internal.py:385
 msgid "Valid not after from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:369
+#: ipalib/plugins/internal.py:386
 msgid "Valid not after to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:370
+#: ipalib/plugins/internal.py:387
 msgid "Valid not before from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:371
+#: ipalib/plugins/internal.py:388
 msgid "Valid not before to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:372
+#: ipalib/plugins/internal.py:389
 msgid "Fingerprints"
 msgstr ""
 
-#: ipalib/plugins/internal.py:373
+#: ipalib/plugins/internal.py:390
 msgid "Get Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:374
+#: ipalib/plugins/internal.py:391
 #, python-brace-format
 msgid "Issue New Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:375
+#: ipalib/plugins/internal.py:392
+msgid "Issue New Certificate"
+msgstr ""
+
+#: ipalib/plugins/internal.py:393
 msgid "Issued By"
 msgstr ""
 
-#: ipalib/plugins/internal.py:376
+#: ipalib/plugins/internal.py:394
 msgid "Issued On"
 msgstr ""
 
-#: ipalib/plugins/internal.py:377
+#: ipalib/plugins/internal.py:395
 msgid "Issued To"
 msgstr ""
 
-#: ipalib/plugins/internal.py:378
+#: ipalib/plugins/internal.py:396
 msgid "Key Compromise"
 msgstr ""
 
-#: ipalib/plugins/internal.py:379
+#: ipalib/plugins/internal.py:397
 msgid "MD5 Fingerprint"
 msgstr ""
 
-#: ipalib/plugins/internal.py:380
+#: ipalib/plugins/internal.py:398
 msgid "No Valid Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:381
+#: ipalib/plugins/internal.py:399
 msgid "New Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:382
+#: ipalib/plugins/internal.py:400
 msgid "Note"
 msgstr ""
 
-#: ipalib/plugins/internal.py:383
+#: ipalib/plugins/internal.py:401
 msgid "Organization"
 msgstr ""
 
-#: ipalib/plugins/internal.py:384
+#: ipalib/plugins/internal.py:402
 msgid "Organizational Unit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:385
+#: ipalib/plugins/internal.py:403
+#, python-brace-format
+msgid "${count} certificate(s) present"
+msgstr ""
+
+#: ipalib/plugins/internal.py:404
 msgid "Privilege Withdrawn"
 msgstr ""
 
-#: ipalib/plugins/internal.py:386
+#: ipalib/plugins/internal.py:405
 msgid "Reason for Revocation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:387
+#: ipalib/plugins/internal.py:406
 msgid "Remove from CRL"
 msgstr ""
 
-#: ipalib/plugins/internal.py:388
+#: ipalib/plugins/internal.py:407
 #, python-brace-format
 msgid ""
 "<ol> <li>Create a certificate database or use an existing one. To create a "
 "new database:<br/> <code># certutil -N -d &lt;database path&gt;</code> </li> "
-"<li>Create a CSR with subject <em>CN=&lt;hostname&gt;,O=&lt;realm&gt;</em>, "
-"for example:<br/> <code># certutil -R -d &lt;database path&gt; -a -g &lt;key "
-"size&gt; -s 'CN=${hostname},O=${realm}'</code> </li> <li> Copy and paste the "
-"CSR (from <em>-----BEGIN NEW CERTIFICATE REQUEST-----</em> to <em>-----END "
-"NEW CERTIFICATE REQUEST-----</em>) into the text area below: </li> </ol>"
+"<li>Create a CSR with subject <em>CN=&lt;${cn_name}&gt;,O=&lt;realm&gt;</"
+"em>, for example:<br/> <code># certutil -R -d &lt;database path&gt; -a -g "
+"&lt;key size&gt; -s 'CN=${cn},O=${realm}'</code> </li> <li> Copy and paste "
+"the CSR (from <em>-----BEGIN NEW CERTIFICATE REQUEST-----</em> to <em>-----"
+"END NEW CERTIFICATE REQUEST-----</em>) into the text area below: </li> </ol>"
 msgstr ""
 
-#: ipalib/plugins/internal.py:389
+#: ipalib/plugins/internal.py:408
 msgid "Certificate requested"
 msgstr ""
 
-#: ipalib/plugins/internal.py:390
+#: ipalib/plugins/internal.py:409
 #, python-brace-format
 msgid "Restore Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:391
+#: ipalib/plugins/internal.py:410
 msgid "Restore Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:392
+#: ipalib/plugins/internal.py:411
 msgid ""
 "To confirm your intention to restore this certificate, click the \"Restore\" "
 "button."
 msgstr ""
 
-#: ipalib/plugins/internal.py:393
+#: ipalib/plugins/internal.py:412
 msgid "Certificate restored"
 msgstr ""
 
-#: ipalib/plugins/internal.py:395
+#: ipalib/plugins/internal.py:414
 #, python-brace-format
 msgid "Revoke Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:396
+#: ipalib/plugins/internal.py:415
 msgid "Revoke Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:397
+#: ipalib/plugins/internal.py:416
 msgid ""
 "To confirm your intention to revoke this certificate, select a reason from "
 "the pull-down list, and click the \"Revoke\" button."
 msgstr ""
 
-#: ipalib/plugins/internal.py:398
+#: ipalib/plugins/internal.py:417
 msgid "Certificate Revoked"
 msgstr ""
 
-#: ipalib/plugins/internal.py:401
+#: ipalib/plugins/internal.py:420
 msgid "SHA1 Fingerprint"
 msgstr ""
 
-#: ipalib/plugins/internal.py:403
+#: ipalib/plugins/internal.py:422
 msgid "Superseded"
 msgstr ""
 
-#: ipalib/plugins/internal.py:404
+#: ipalib/plugins/internal.py:423
 msgid "Unspecified"
 msgstr ""
 
-#: ipalib/plugins/internal.py:405
+#: ipalib/plugins/internal.py:424
 msgid "Valid Certificate Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:406
+#: ipalib/plugins/internal.py:425
 msgid "Validity"
 msgstr ""
 
-#: ipalib/plugins/internal.py:407
+#: ipalib/plugins/internal.py:426
 #, python-brace-format
 msgid "Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:408
+#: ipalib/plugins/internal.py:427
 msgid "View Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:411
+#: ipalib/plugins/internal.py:430
 msgid "Group Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:412
+#: ipalib/plugins/internal.py:431
 msgid "Search Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:413
+#: ipalib/plugins/internal.py:432
 msgid "SELinux Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:414
+#: ipalib/plugins/internal.py:433
 msgid "Service Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:415
+#: ipalib/plugins/internal.py:434
 msgid "User Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:420
+#: ipalib/plugins/internal.py:439
 msgid "Forward first"
 msgstr ""
 
-#: ipalib/plugins/internal.py:421
+#: ipalib/plugins/internal.py:440
 msgid "Forwarding disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:422
+#: ipalib/plugins/internal.py:441
 msgid "Forward only"
 msgstr ""
 
-#: ipalib/plugins/internal.py:423 ipalib/plugins/internal.py:692
-#: ipalib/plugins/internal.py:720
+#: ipalib/plugins/internal.py:442 ipalib/plugins/internal.py:711
+#: ipalib/plugins/internal.py:740
 msgid "Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:426 ipalib/plugins/vault.py:687
+#: ipalib/plugins/internal.py:445 ipalib/plugins/vault.py:1805
 msgid "Data"
 msgstr ""
 
-#: ipalib/plugins/internal.py:427
+#: ipalib/plugins/internal.py:446
 msgid "DNS record was deleted because it contained no data."
 msgstr ""
 
-#: ipalib/plugins/internal.py:428
+#: ipalib/plugins/internal.py:447
 msgid "Other Record Types"
 msgstr ""
 
-#: ipalib/plugins/internal.py:429
+#: ipalib/plugins/internal.py:448
 msgid "Address not valid, can't redirect"
 msgstr ""
 
-#: ipalib/plugins/internal.py:430
+#: ipalib/plugins/internal.py:449
 msgid "Create dns record"
 msgstr ""
 
-#: ipalib/plugins/internal.py:431
+#: ipalib/plugins/internal.py:450
 msgid "Creating record."
 msgstr ""
 
-#: ipalib/plugins/internal.py:432
+#: ipalib/plugins/internal.py:451
 msgid "Record creation failed."
 msgstr ""
 
-#: ipalib/plugins/internal.py:433
+#: ipalib/plugins/internal.py:452
 msgid "Checking if record exists."
 msgstr ""
 
-#: ipalib/plugins/internal.py:434
+#: ipalib/plugins/internal.py:453
 msgid "Record not found."
 msgstr ""
 
-#: ipalib/plugins/internal.py:435
+#: ipalib/plugins/internal.py:454
 msgid "Redirection to PTR record"
 msgstr ""
 
-#: ipalib/plugins/internal.py:436
+#: ipalib/plugins/internal.py:455
 #, python-brace-format
 msgid "Zone found: ${zone}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:437
+#: ipalib/plugins/internal.py:456
 msgid "Target reverse zone not found."
 msgstr ""
 
-#: ipalib/plugins/internal.py:438
+#: ipalib/plugins/internal.py:457
 msgid "Fetching DNS zones."
 msgstr ""
 
-#: ipalib/plugins/internal.py:439
+#: ipalib/plugins/internal.py:458
 msgid "An error occurred while fetching dns zones."
 msgstr ""
 
-#: ipalib/plugins/internal.py:440
+#: ipalib/plugins/internal.py:459
 msgid "You will be redirected to DNS Zone."
 msgstr ""
 
-#: ipalib/plugins/internal.py:441
+#: ipalib/plugins/internal.py:460
 msgid "Standard Record Types"
 msgstr ""
 
-#: ipalib/plugins/internal.py:442
+#: ipalib/plugins/internal.py:461
 msgid "Records for DNS Zone"
 msgstr ""
 
-#: ipalib/plugins/internal.py:443
+#: ipalib/plugins/internal.py:462
 msgid "Record Type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:446
+#: ipalib/plugins/internal.py:465
 msgid "DNS Zone Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:447
+#: ipalib/plugins/internal.py:466
 msgid "Add Permission"
 msgstr ""
 
-#: ipalib/plugins/internal.py:448
+#: ipalib/plugins/internal.py:467
 #, python-brace-format
 msgid "Are you sure you want to add permission for DNS Zone ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:449
+#: ipalib/plugins/internal.py:468
 msgid "Remove Permission"
 msgstr ""
 
-#: ipalib/plugins/internal.py:450
+#: ipalib/plugins/internal.py:469
 #, python-brace-format
 msgid "Are you sure you want to remove permission for DNS Zone ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:451
+#: ipalib/plugins/internal.py:470
 msgid "Skip DNS check"
 msgstr ""
 
-#: ipalib/plugins/internal.py:452
+#: ipalib/plugins/internal.py:471
 msgid "Do you want to check if new authoritative nameserver address is in DNS"
 msgstr ""
 
-#: ipalib/plugins/internal.py:453
+#: ipalib/plugins/internal.py:472
 msgid "Authoritative nameserver change"
 msgstr ""
 
-#: ipalib/plugins/internal.py:458
+#: ipalib/plugins/internal.py:477
 msgid "Level"
 msgstr ""
 
-#: ipalib/plugins/internal.py:459
+#: ipalib/plugins/internal.py:478
 msgid "Set Domain Level"
 msgstr ""
 
-#: ipalib/plugins/internal.py:462
+#: ipalib/plugins/internal.py:481
 msgid "Group Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:463 ipalib/plugins/internal.py:564
-#: ipalib/plugins/internal.py:687
+#: ipalib/plugins/internal.py:482 ipalib/plugins/internal.py:583
+#: ipalib/plugins/internal.py:706
 msgid "External"
 msgstr ""
 
-#: ipalib/plugins/internal.py:464
+#: ipalib/plugins/internal.py:483
 msgid "Change to external group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:465
+#: ipalib/plugins/internal.py:484
 msgid "Change to POSIX group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:466
+#: ipalib/plugins/internal.py:485
 msgid "Normal"
 msgstr ""
 
-#: ipalib/plugins/internal.py:467
+#: ipalib/plugins/internal.py:486
 msgid "POSIX"
 msgstr ""
 
-#: ipalib/plugins/internal.py:468
+#: ipalib/plugins/internal.py:487
 msgid "Group Type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:471 ipalib/plugins/internal.py:562
-#: ipalib/plugins/internal.py:632 ipalib/plugins/internal.py:683
-msgid "Any Host"
-msgstr ""
-
-#: ipalib/plugins/internal.py:472
-msgid "Any Service"
-msgstr ""
-
-#: ipalib/plugins/internal.py:473 ipalib/plugins/internal.py:563
-#: ipalib/plugins/internal.py:633 ipalib/plugins/internal.py:684
-msgid "Anyone"
-msgstr ""
-
-#: ipalib/plugins/internal.py:474
+#: ipalib/plugins/internal.py:493
 msgid "Accessing"
 msgstr ""
 
-#: ipalib/plugins/internal.py:475 ipalib/plugins/internal.py:689
-msgid "Rule status"
-msgstr ""
-
-#: ipalib/plugins/internal.py:476
+#: ipalib/plugins/internal.py:495
 msgid "Via Service"
 msgstr ""
 
-#: ipalib/plugins/internal.py:477 ipalib/plugins/internal.py:569
-#: ipalib/plugins/internal.py:635 ipalib/plugins/internal.py:696
-msgid "Specified Hosts and Groups"
-msgstr ""
-
-#: ipalib/plugins/internal.py:478
-msgid "Specified Services and Groups"
-msgstr ""
-
-#: ipalib/plugins/internal.py:479 ipalib/plugins/internal.py:570
-#: ipalib/plugins/internal.py:636 ipalib/plugins/internal.py:697
-msgid "Specified Users and Groups"
-msgstr ""
-
-#: ipalib/plugins/internal.py:480 ipalib/plugins/internal.py:698
+#: ipalib/plugins/internal.py:499 ipalib/plugins/internal.py:717
 msgid "Who"
 msgstr ""
 
-#: ipalib/plugins/internal.py:488
+#: ipalib/plugins/internal.py:507
 msgid "Access Denied"
 msgstr ""
 
-#: ipalib/plugins/internal.py:489
+#: ipalib/plugins/internal.py:508
 msgid "Access Granted"
 msgstr ""
 
-#: ipalib/plugins/internal.py:490
+#: ipalib/plugins/internal.py:509
 msgid "Include Disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:491
+#: ipalib/plugins/internal.py:510
 msgid "Include Enabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:492
+#: ipalib/plugins/internal.py:511
 msgid "HBAC Test"
 msgstr ""
 
-#: ipalib/plugins/internal.py:493
+#: ipalib/plugins/internal.py:512
 msgid "Matched"
 msgstr ""
 
-#: ipalib/plugins/internal.py:494
+#: ipalib/plugins/internal.py:513
 msgid "Missing values: "
 msgstr ""
 
-#: ipalib/plugins/internal.py:495
+#: ipalib/plugins/internal.py:514
 msgid "New Test"
 msgstr ""
 
-#: ipalib/plugins/internal.py:496
+#: ipalib/plugins/internal.py:515
 msgid "Rules"
 msgstr ""
 
-#: ipalib/plugins/internal.py:497
+#: ipalib/plugins/internal.py:516
 msgid "Run Test"
 msgstr ""
 
-#: ipalib/plugins/internal.py:498
+#: ipalib/plugins/internal.py:517
 #, python-brace-format
 msgid "Specify external ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:499
+#: ipalib/plugins/internal.py:518
 msgid "Unmatched"
 msgstr ""
 
-#: ipalib/plugins/internal.py:502
+#: ipalib/plugins/internal.py:521
 msgid "Host Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:503 ipalib/plugins/internal.py:643
+#: ipalib/plugins/internal.py:522 ipalib/plugins/internal.py:662
 msgid "Host Name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:504 ipalib/plugins/internal.py:641
+#: ipalib/plugins/internal.py:523 ipalib/plugins/internal.py:660
 msgid "Delete Key, Unprovision"
 msgstr ""
 
-#: ipalib/plugins/internal.py:505
+#: ipalib/plugins/internal.py:524
 msgid "Host Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:506
+#: ipalib/plugins/internal.py:525
 msgid "Enrolled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:507
+#: ipalib/plugins/internal.py:526
 msgid "Enrollment"
 msgstr ""
 
-#: ipalib/plugins/internal.py:508
+#: ipalib/plugins/internal.py:527
 msgid "Fully Qualified Host Name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:509
+#: ipalib/plugins/internal.py:528
 msgid "Kerberos Key"
 msgstr ""
 
-#: ipalib/plugins/internal.py:510 ipalib/plugins/internal.py:644
+#: ipalib/plugins/internal.py:529 ipalib/plugins/internal.py:663
 msgid "Kerberos Key Not Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:511
+#: ipalib/plugins/internal.py:530
 msgid "Kerberos Key Present, Host Provisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:512 ipalib/plugins/internal.py:752
+#: ipalib/plugins/internal.py:531 ipalib/plugins/internal.py:772
 msgid "One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:513
+#: ipalib/plugins/internal.py:532
 msgid "One-Time-Password Not Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:514
+#: ipalib/plugins/internal.py:533
 msgid "One-Time-Password Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:515
+#: ipalib/plugins/internal.py:534
 msgid "Reset OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:516
+#: ipalib/plugins/internal.py:535
 msgid "Reset One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:517
+#: ipalib/plugins/internal.py:536
 msgid "Set OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:518
+#: ipalib/plugins/internal.py:537
 msgid "OTP set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:519
+#: ipalib/plugins/internal.py:538
 msgid "Set One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:521 ipalib/plugins/internal.py:648
+#: ipalib/plugins/internal.py:540 ipalib/plugins/internal.py:667
 msgid "Unprovision"
 msgstr ""
 
-#: ipalib/plugins/internal.py:522
+#: ipalib/plugins/internal.py:541
 msgid "Are you sure you want to unprovision this host?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:523 ipalib/plugins/internal.py:650
+#: ipalib/plugins/internal.py:542 ipalib/plugins/internal.py:669
 #, python-brace-format
 msgid "Unprovisioning ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:524
+#: ipalib/plugins/internal.py:543
 msgid "Host unprovisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:527
+#: ipalib/plugins/internal.py:546
 msgid "Host Group Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:530
+#: ipalib/plugins/internal.py:549
 msgid "User to override"
 msgstr ""
 
-#: ipalib/plugins/internal.py:531
+#: ipalib/plugins/internal.py:550
 msgid ""
 "Enter trusted or IPA user login. Note: search doesn't list users from "
 "trusted domains."
 msgstr ""
 
-#: ipalib/plugins/internal.py:532
+#: ipalib/plugins/internal.py:551
 msgid "Enter trusted user login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:535
+#: ipalib/plugins/internal.py:554
 msgid "Group to override"
 msgstr ""
 
-#: ipalib/plugins/internal.py:536
+#: ipalib/plugins/internal.py:555
 msgid ""
 "Enter trusted or IPA group name. Note: search doesn't list groups from "
 "trusted domains."
 msgstr ""
 
-#: ipalib/plugins/internal.py:537
+#: ipalib/plugins/internal.py:556
 msgid "Enter trusted group name."
 msgstr ""
 
-#: ipalib/plugins/internal.py:540
+#: ipalib/plugins/internal.py:559
 #, python-brace-format
 msgid "${primary_key} applies to:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:541 ipalib/plugins/internal.py:542
+#: ipalib/plugins/internal.py:560 ipalib/plugins/internal.py:561
 msgid "Applied to hosts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:543
+#: ipalib/plugins/internal.py:562
 msgid "Apply to host groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:544
+#: ipalib/plugins/internal.py:563
 #, python-brace-format
 msgid "Apply ID View ${primary_key} on hosts of ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:545
+#: ipalib/plugins/internal.py:564
 msgid "Apply to hosts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:546
+#: ipalib/plugins/internal.py:565
 #, python-brace-format
 msgid "Apply ID view ${primary_key} on ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:548
+#: ipalib/plugins/internal.py:567
 #, python-brace-format
 msgid "${primary_key} overrides:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:549
+#: ipalib/plugins/internal.py:568
 msgid "Un-apply from host groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:550
+#: ipalib/plugins/internal.py:569
 msgid "Un-apply ID Views from hosts of hostgroups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:551
+#: ipalib/plugins/internal.py:570
 #, python-brace-format
 msgid "Un-apply ID View ${primary_key} from hosts of ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:552
+#: ipalib/plugins/internal.py:571
 msgid "Un-apply"
 msgstr ""
 
-#: ipalib/plugins/internal.py:553
+#: ipalib/plugins/internal.py:572
 msgid "Un-apply from hosts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:554
+#: ipalib/plugins/internal.py:573
 msgid "Un-apply ID Views from hosts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:555
+#: ipalib/plugins/internal.py:574
 msgid "Are you sure you want to un-apply ID view from selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:556
+#: ipalib/plugins/internal.py:575
 #, python-brace-format
 msgid "Un-apply ID View ${primary_key} from hosts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:559 ipalib/plugins/krbtpolicy.py:118
+#: ipalib/plugins/internal.py:578 ipalib/plugins/krbtpolicy.py:118
 #: ipalib/plugins/krbtpolicy.py:119
 msgid "Kerberos Ticket Policy"
 msgstr ""
 
-#: ipalib/plugins/internal.py:568
+#: ipalib/plugins/internal.py:587
 msgid "Netgroup Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:576
+#: ipalib/plugins/internal.py:595
 msgid "Add OTP Token"
 msgstr ""
 
-#: ipalib/plugins/internal.py:577
+#: ipalib/plugins/internal.py:596
 #, python-brace-format
 msgid ""
 "You can use <a href=\"${link}\" target=\"_blank\">FreeOTP<a/> as a software "
 "OTP token application."
 msgstr ""
 
-#: ipalib/plugins/internal.py:578
+#: ipalib/plugins/internal.py:597
 msgid "Configure your token"
 msgstr ""
 
-#: ipalib/plugins/internal.py:579
+#: ipalib/plugins/internal.py:598
 msgid ""
 "Configure your token by scanning the QR code below. Click on the QR code if "
 "you see this on the device you want to configure."
 msgstr ""
 
-#: ipalib/plugins/internal.py:580
+#: ipalib/plugins/internal.py:599
 msgid "OTP Token Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:581
+#: ipalib/plugins/internal.py:600
 msgid "Disable token"
 msgstr ""
 
-#: ipalib/plugins/internal.py:582
+#: ipalib/plugins/internal.py:601
 msgid "Enable token"
 msgstr ""
 
-#: ipalib/plugins/internal.py:583
+#: ipalib/plugins/internal.py:602
 msgid "Show QR code"
 msgstr ""
 
-#: ipalib/plugins/internal.py:584
+#: ipalib/plugins/internal.py:603
 msgid "Show configuration uri"
 msgstr ""
 
-#: ipalib/plugins/internal.py:585
+#: ipalib/plugins/internal.py:604
 msgid "Counter-based (HOTP)"
 msgstr ""
 
-#: ipalib/plugins/internal.py:586
+#: ipalib/plugins/internal.py:605
 msgid "Time-based (TOTP)"
 msgstr ""
 
-#: ipalib/plugins/internal.py:589
+#: ipalib/plugins/internal.py:608
 msgid "Add custom attribute"
 msgstr ""
 
-#: ipalib/plugins/internal.py:592
+#: ipalib/plugins/internal.py:611
 msgid "Permission settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:593
+#: ipalib/plugins/internal.py:612
 msgid "Attribute breakdown"
 msgstr ""
 
-#: ipalib/plugins/internal.py:597
+#: ipalib/plugins/internal.py:616
 msgid "Privilege Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:600 ipalib/plugins/pwpolicy.py:308
+#: ipalib/plugins/internal.py:619 ipalib/plugins/pwpolicy.py:313
 msgid "Password Policy"
 msgstr ""
 
-#: ipalib/plugins/internal.py:603
+#: ipalib/plugins/internal.py:622
 msgid "Range Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:604
+#: ipalib/plugins/internal.py:623
 msgid "Base ID"
 msgstr ""
 
-#: ipalib/plugins/internal.py:605
+#: ipalib/plugins/internal.py:624
 msgid "Primary RID base"
 msgstr ""
 
-#: ipalib/plugins/internal.py:606
+#: ipalib/plugins/internal.py:625
 msgid "Range size"
 msgstr ""
 
-#: ipalib/plugins/internal.py:607
+#: ipalib/plugins/internal.py:626
 msgid "Domain SID"
 msgstr ""
 
-#: ipalib/plugins/internal.py:608
+#: ipalib/plugins/internal.py:627
 msgid "Secondary RID base"
 msgstr ""
 
-#: ipalib/plugins/internal.py:610 ipalib/plugins/trust.py:145
+#: ipalib/plugins/internal.py:629 ipalib/plugins/trust.py:153
 msgid "Active Directory domain"
 msgstr ""
 
-#: ipalib/plugins/internal.py:611
+#: ipalib/plugins/internal.py:630
 msgid "Active Directory domain with POSIX attributes"
 msgstr ""
 
-#: ipalib/plugins/internal.py:612
+#: ipalib/plugins/internal.py:631
 msgid "Detect"
 msgstr ""
 
-#: ipalib/plugins/internal.py:613
+#: ipalib/plugins/internal.py:632
 msgid "Local domain"
 msgstr ""
 
-#: ipalib/plugins/internal.py:614
+#: ipalib/plugins/internal.py:633
 msgid "IPA trust"
 msgstr ""
 
-#: ipalib/plugins/internal.py:615
+#: ipalib/plugins/internal.py:634
 msgid "Active Directory winsync"
 msgstr ""
 
-#: ipalib/plugins/internal.py:618
+#: ipalib/plugins/internal.py:637
 msgid "RADIUS Proxy Server Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:621 ipalib/plugins/realmdomains.py:92
-#: ipalib/plugins/realmdomains.py:93
+#: ipalib/plugins/internal.py:640 ipalib/plugins/realmdomains.py:97
+#: ipalib/plugins/realmdomains.py:98
 msgid "Realm Domains"
 msgstr ""
 
-#: ipalib/plugins/internal.py:622
+#: ipalib/plugins/internal.py:641
 msgid "Check DNS"
 msgstr ""
 
-#: ipalib/plugins/internal.py:623
+#: ipalib/plugins/internal.py:642
 msgid "Do you also want to perform DNS check?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:624
+#: ipalib/plugins/internal.py:643
 msgid "Force Update"
 msgstr ""
 
-#: ipalib/plugins/internal.py:627
+#: ipalib/plugins/internal.py:646
 msgid "Role Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:640
+#: ipalib/plugins/internal.py:659
 msgid "Service Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:642
+#: ipalib/plugins/internal.py:661
 msgid "Service Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:645
+#: ipalib/plugins/internal.py:664
 msgid "Provisioning"
 msgstr ""
 
-#: ipalib/plugins/internal.py:649
+#: ipalib/plugins/internal.py:668
 msgid "Are you sure you want to unprovision this service?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:651
+#: ipalib/plugins/internal.py:670
 msgid "Service unprovisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:652
+#: ipalib/plugins/internal.py:671
 msgid "Kerberos Key Present, Service Provisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:655
+#: ipalib/plugins/internal.py:674
 msgid "SSH public keys"
 msgstr ""
 
-#: ipalib/plugins/internal.py:656
+#: ipalib/plugins/internal.py:675
 msgid "SSH public key:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:657
+#: ipalib/plugins/internal.py:676
 msgid "Set SSH key"
 msgstr ""
 
-#: ipalib/plugins/internal.py:658
+#: ipalib/plugins/internal.py:677
 msgid "Show/Set key"
 msgstr ""
 
-#: ipalib/plugins/internal.py:659
+#: ipalib/plugins/internal.py:678
 msgid "Modified: key not set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:660
+#: ipalib/plugins/internal.py:679
 msgid "Modified"
 msgstr ""
 
-#: ipalib/plugins/internal.py:661
+#: ipalib/plugins/internal.py:680
 msgid "New: key not set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:662
+#: ipalib/plugins/internal.py:681
 msgid "New: key set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:665
+#: ipalib/plugins/internal.py:684
 msgid "Are you sure you want to activate selected users?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:666
+#: ipalib/plugins/internal.py:685
 #, python-brace-format
 msgid "${count} user(s) activated"
 msgstr ""
 
-#: ipalib/plugins/internal.py:667
+#: ipalib/plugins/internal.py:686
 msgid "Stage users"
 msgstr ""
 
-#: ipalib/plugins/internal.py:668
+#: ipalib/plugins/internal.py:687
 msgid "Preserved users"
 msgstr ""
 
-#: ipalib/plugins/internal.py:669
+#: ipalib/plugins/internal.py:688
 msgid "Are you sure you want to restore selected users?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:670
+#: ipalib/plugins/internal.py:689
 #, python-brace-format
 msgid "${count} user(s) restored"
 msgstr ""
 
-#: ipalib/plugins/internal.py:671
+#: ipalib/plugins/internal.py:690
 msgid "User categories"
 msgstr ""
 
-#: ipalib/plugins/internal.py:674
+#: ipalib/plugins/internal.py:693
 msgid "Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:677 ipalib/plugins/sudocmdgroup.py:126
+#: ipalib/plugins/internal.py:696 ipalib/plugins/sudocmdgroup.py:126
 msgid "Commands"
 msgstr ""
 
-#: ipalib/plugins/internal.py:680
+#: ipalib/plugins/internal.py:699
 msgid "Allow"
 msgstr ""
 
-#: ipalib/plugins/internal.py:681
+#: ipalib/plugins/internal.py:700
 msgid "Any Command"
 msgstr ""
 
-#: ipalib/plugins/internal.py:682
+#: ipalib/plugins/internal.py:701
 msgid "Any Group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:685
+#: ipalib/plugins/internal.py:704
 msgid "Run Commands"
 msgstr ""
 
-#: ipalib/plugins/internal.py:686
+#: ipalib/plugins/internal.py:705
 msgid "Deny"
 msgstr ""
 
-#: ipalib/plugins/internal.py:688
+#: ipalib/plugins/internal.py:707
 msgid "Access this host"
 msgstr ""
 
-#: ipalib/plugins/internal.py:690
+#: ipalib/plugins/internal.py:709
 msgid "Option added"
 msgstr ""
 
-#: ipalib/plugins/internal.py:691
+#: ipalib/plugins/internal.py:710
 #, python-brace-format
 msgid "${count} option(s) removed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:693
+#: ipalib/plugins/internal.py:712
 msgid "As Whom"
 msgstr ""
 
-#: ipalib/plugins/internal.py:694
+#: ipalib/plugins/internal.py:713
 msgid "Specified Commands and Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:695
+#: ipalib/plugins/internal.py:714
 msgid "Specified Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:701
+#: ipalib/plugins/internal.py:720
 msgid "Segment details"
 msgstr ""
 
-#: ipalib/plugins/internal.py:702
+#: ipalib/plugins/internal.py:721
 msgid "Replication configuration"
 msgstr ""
 
-#: ipalib/plugins/internal.py:705
+#: ipalib/plugins/internal.py:722
+#, python-brace-format
+msgid "Managed topology requires minimal domain level ${domainlevel}"
+msgstr ""
+
+#: ipalib/plugins/internal.py:725
 msgid "Account"
 msgstr ""
 
-#: ipalib/plugins/internal.py:706
+#: ipalib/plugins/internal.py:726
 msgid "Administrative account"
 msgstr ""
 
-#: ipalib/plugins/internal.py:707
+#: ipalib/plugins/internal.py:727
 msgid "SID blacklists"
 msgstr ""
 
-#: ipalib/plugins/internal.py:708
+#: ipalib/plugins/internal.py:728
 msgid "Trust Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:709 ipalib/plugins/realmdomains.py:100
-#: ipalib/plugins/trust.py:878
+#: ipalib/plugins/internal.py:729 ipalib/plugins/realmdomains.py:105
+#: ipalib/plugins/trust.py:1093
 msgid "Domain"
 msgstr ""
 
-#: ipalib/plugins/internal.py:710
+#: ipalib/plugins/internal.py:730
 msgid "Establish using"
 msgstr ""
 
-#: ipalib/plugins/internal.py:711
+#: ipalib/plugins/internal.py:731
 msgid "Fetch domains"
 msgstr ""
 
-#: ipalib/plugins/internal.py:712 ipalib/plugins/trust.py:357
-#: ipalib/plugins/trust.py:1195
+#: ipalib/plugins/internal.py:732 ipalib/plugins/trust.py:508
+#: ipalib/plugins/trust.py:1410
 msgid "Domain NetBIOS name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:713 ipalib/plugins/trust.py:361
-#: ipalib/plugins/trust.py:1199
+#: ipalib/plugins/internal.py:733 ipalib/plugins/trust.py:512
+#: ipalib/plugins/trust.py:1414
 msgid "Domain Security Identifier"
 msgstr ""
 
-#: ipalib/plugins/internal.py:714
+#: ipalib/plugins/internal.py:734
 msgid "Pre-shared password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:715 ipalib/plugins/trust.py:137
+#: ipalib/plugins/internal.py:735 ipalib/plugins/trust.py:145
 msgid "Trust direction"
 msgstr ""
 
-#: ipalib/plugins/internal.py:716 ipalib/plugins/trust.py:141
+#: ipalib/plugins/internal.py:736 ipalib/plugins/trust.py:149
 msgid "Trust status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:717 ipalib/plugins/trust.py:139
+#: ipalib/plugins/internal.py:737 ipalib/plugins/trust.py:147
 msgid "Trust type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:723
+#: ipalib/plugins/internal.py:743
 msgid "Account Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:724
+#: ipalib/plugins/internal.py:744
 msgid "Account Status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:725
+#: ipalib/plugins/internal.py:745
 msgid "Active users"
 msgstr ""
 
-#: ipalib/plugins/internal.py:726
+#: ipalib/plugins/internal.py:746
 msgid "Contact Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:727
+#: ipalib/plugins/internal.py:747
 msgid "Delete mode"
 msgstr ""
 
-#: ipalib/plugins/internal.py:728
+#: ipalib/plugins/internal.py:748
 msgid "Employee Information"
 msgstr ""
 
-#: ipalib/plugins/internal.py:729
+#: ipalib/plugins/internal.py:749
 msgid "Error changing account status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:730
+#: ipalib/plugins/internal.py:750
 msgid "Password expiration"
 msgstr ""
 
-#: ipalib/plugins/internal.py:731
+#: ipalib/plugins/internal.py:751
 msgid "Mailing Address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:732
+#: ipalib/plugins/internal.py:752
 msgid "Misc. Information"
 msgstr ""
 
-#: ipalib/plugins/internal.py:733
+#: ipalib/plugins/internal.py:753
 msgid "delete"
 msgstr ""
 
-#: ipalib/plugins/internal.py:734
+#: ipalib/plugins/internal.py:754
 msgid "preserve"
 msgstr ""
 
-#: ipalib/plugins/internal.py:735
+#: ipalib/plugins/internal.py:755
 msgid "No private group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:736
+#: ipalib/plugins/internal.py:756
 #, python-brace-format
 msgid ""
 "Are you sure you want to ${action} the user?<br/>The change will take effect "
 "immediately."
 msgstr ""
 
-#: ipalib/plugins/internal.py:737
+#: ipalib/plugins/internal.py:757
 #, python-brace-format
 msgid "Click to ${action}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:738
+#: ipalib/plugins/internal.py:758
 msgid "Unlock"
 msgstr ""
 
-#: ipalib/plugins/internal.py:739
+#: ipalib/plugins/internal.py:759
 #, python-brace-format
 msgid "Are you sure you want to unlock user ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:743 ipalib/plugins/passwd.py:84
+#: ipalib/plugins/internal.py:763 ipalib/plugins/passwd.py:84
 msgid "Current Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:744
+#: ipalib/plugins/internal.py:764
 msgid "Current password is required"
 msgstr ""
 
-#: ipalib/plugins/internal.py:745
+#: ipalib/plugins/internal.py:765
 #, python-brace-format
 msgid "Your password expires in ${days} days."
 msgstr ""
 
-#: ipalib/plugins/internal.py:746
+#: ipalib/plugins/internal.py:766
 msgid "First OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:747
+#: ipalib/plugins/internal.py:767
 msgid "The password or username you entered is incorrect."
 msgstr ""
 
-#: ipalib/plugins/internal.py:748 ipalib/plugins/passwd.py:81
+#: ipalib/plugins/internal.py:768 ipalib/plugins/passwd.py:81
 msgid "New Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:749
+#: ipalib/plugins/internal.py:769
 msgid "New password is required"
 msgstr ""
 
-#: ipalib/plugins/internal.py:750 ipalib/plugins/passwd.py:94
+#: ipalib/plugins/internal.py:770 ipalib/plugins/passwd.py:94
 msgid "OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:751
+#: ipalib/plugins/internal.py:771
 msgid ""
 "<i class=\"fa fa-info-circle\"></i> <strong>One-Time-Password(OTP):</strong> "
 "Generate new OTP code for each OTP field."
 msgstr ""
 
-#: ipalib/plugins/internal.py:753
+#: ipalib/plugins/internal.py:773
 msgid "Token synchronization failed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:754
+#: ipalib/plugins/internal.py:774
 msgid "The username, password or token codes are not correct"
 msgstr ""
 
-#: ipalib/plugins/internal.py:755
+#: ipalib/plugins/internal.py:775
 msgid "Token was synchronized"
 msgstr ""
 
-#: ipalib/plugins/internal.py:757
+#: ipalib/plugins/internal.py:777
 msgid "Password or Password+One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:758
+#: ipalib/plugins/internal.py:778
 msgid "Password change complete"
 msgstr ""
 
-#: ipalib/plugins/internal.py:759
+#: ipalib/plugins/internal.py:779
 msgid "Passwords must match"
 msgstr ""
 
-#: ipalib/plugins/internal.py:760
+#: ipalib/plugins/internal.py:780
 msgid "Password reset was not successful."
 msgstr ""
 
-#: ipalib/plugins/internal.py:761
+#: ipalib/plugins/internal.py:781
 msgid "Reset Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:762
+#: ipalib/plugins/internal.py:782
 msgid "Reset your password."
 msgstr ""
 
-#: ipalib/plugins/internal.py:763
+#: ipalib/plugins/internal.py:783
 msgid "Second OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:764 ipalib/plugins/otptoken.py:528
+#: ipalib/plugins/internal.py:784 ipalib/plugins/otptoken.py:513
 msgid "Token ID"
 msgstr ""
 
-#: ipalib/plugins/internal.py:765
+#: ipalib/plugins/internal.py:785
 msgid "Verify Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:768
+#: ipalib/plugins/internal.py:788
 msgid "Are you sure you want to delete selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:769
+#: ipalib/plugins/internal.py:789
 #, python-brace-format
 msgid "${count} item(s) deleted"
 msgstr ""
 
-#: ipalib/plugins/internal.py:770
+#: ipalib/plugins/internal.py:790
 msgid "Are you sure you want to disable selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:771
+#: ipalib/plugins/internal.py:791
 #, python-brace-format
 msgid "${count} item(s) disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:772
+#: ipalib/plugins/internal.py:792
 msgid "Are you sure you want to enable selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:773
+#: ipalib/plugins/internal.py:793
 #, python-brace-format
 msgid "${count} item(s) enabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:774
+#: ipalib/plugins/internal.py:794
 msgid "Some entries were not deleted"
 msgstr ""
 
-#: ipalib/plugins/internal.py:776
+#: ipalib/plugins/internal.py:796
 msgid "Quick Links"
 msgstr ""
 
-#: ipalib/plugins/internal.py:777
+#: ipalib/plugins/internal.py:797
 msgid "Select All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:778
+#: ipalib/plugins/internal.py:798
 #, python-brace-format
 msgid ""
 "Query returned more results than the configured size limit. Displaying the "
 "first ${counter} results."
 msgstr ""
 
-#: ipalib/plugins/internal.py:779
+#: ipalib/plugins/internal.py:799
 msgid "Unselect All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:783 ipalib/plugins/otptoken.py:184
+#: ipalib/plugins/internal.py:803 ipalib/plugins/otptoken.py:188
 msgid "Disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:787
+#: ipalib/plugins/internal.py:807
 msgid "Working"
 msgstr ""
 
-#: ipalib/plugins/internal.py:790
+#: ipalib/plugins/internal.py:810
 msgid "Audit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:791
+#: ipalib/plugins/internal.py:811
 msgid "Authentication"
 msgstr ""
 
-#: ipalib/plugins/internal.py:793
+#: ipalib/plugins/internal.py:813
 msgid "Automount"
 msgstr ""
 
-#: ipalib/plugins/internal.py:795
+#: ipalib/plugins/internal.py:815
 msgid "DNS"
 msgstr ""
 
-#: ipalib/plugins/internal.py:796
+#: ipalib/plugins/internal.py:816
 msgid "Host Based Access Control"
 msgstr ""
 
-#: ipalib/plugins/internal.py:797
+#: ipalib/plugins/internal.py:817
 msgid "Identity"
 msgstr ""
 
-#: ipalib/plugins/internal.py:798 ipalib/plugins/server.py:46
+#: ipalib/plugins/internal.py:818 ipalib/plugins/server.py:47
 msgid "IPA Server"
 msgstr ""
 
-#: ipalib/plugins/internal.py:799
+#: ipalib/plugins/internal.py:819
 msgid "Network Services"
 msgstr ""
 
-#: ipalib/plugins/internal.py:800
+#: ipalib/plugins/internal.py:820
 msgid "Policy"
 msgstr ""
 
-#: ipalib/plugins/internal.py:801
+#: ipalib/plugins/internal.py:821
 msgid "Role Based Access Control"
 msgstr ""
 
-#: ipalib/plugins/internal.py:802
+#: ipalib/plugins/internal.py:822
 msgid "Sudo"
 msgstr ""
 
-#: ipalib/plugins/internal.py:803
+#: ipalib/plugins/internal.py:823
 msgid "Topology"
 msgstr ""
 
-#: ipalib/plugins/internal.py:804 ipalib/plugins/trust.py:346
+#: ipalib/plugins/internal.py:824 ipalib/plugins/trust.py:497
 msgid "Trusts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:806
+#: ipalib/plugins/internal.py:826
 msgid "True"
 msgstr ""
 
-#: ipalib/plugins/internal.py:808
+#: ipalib/plugins/internal.py:828
 msgid "First"
 msgstr ""
 
-#: ipalib/plugins/internal.py:809
+#: ipalib/plugins/internal.py:829
 msgid "Last"
 msgstr ""
 
-#: ipalib/plugins/internal.py:810
+#: ipalib/plugins/internal.py:830
 msgid "Next"
 msgstr ""
 
-#: ipalib/plugins/internal.py:811
+#: ipalib/plugins/internal.py:831
 msgid "Page"
 msgstr ""
 
-#: ipalib/plugins/internal.py:812
+#: ipalib/plugins/internal.py:832
 msgid "Prev"
 msgstr ""
 
-#: ipalib/plugins/internal.py:813
+#: ipalib/plugins/internal.py:833
 msgid "Undo"
 msgstr ""
 
-#: ipalib/plugins/internal.py:814
+#: ipalib/plugins/internal.py:834
 msgid "Undo All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:816
+#: ipalib/plugins/internal.py:836
 msgid "Text does not match field pattern"
 msgstr ""
 
-#: ipalib/plugins/internal.py:817
+#: ipalib/plugins/internal.py:837
 msgid "Must be an UTC date/time value (e.g., \"2014-01-20 17:58:01Z\")"
 msgstr ""
 
-#: ipalib/plugins/internal.py:818
+#: ipalib/plugins/internal.py:838
 msgid "Must be a decimal number"
 msgstr ""
 
-#: ipalib/plugins/internal.py:819
+#: ipalib/plugins/internal.py:839
 msgid "Format error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:820
+#: ipalib/plugins/internal.py:840
 msgid "Must be an integer"
 msgstr ""
 
-#: ipalib/plugins/internal.py:821
+#: ipalib/plugins/internal.py:841
 msgid "Not a valid IP address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:822
+#: ipalib/plugins/internal.py:842
 msgid "Not a valid IPv4 address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:823
+#: ipalib/plugins/internal.py:843
 msgid "Not a valid IPv6 address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:824
+#: ipalib/plugins/internal.py:844
 #, python-brace-format
 msgid "Maximum value is ${value}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:825
+#: ipalib/plugins/internal.py:845
 #, python-brace-format
 msgid "Minimum value is ${value}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:826
+#: ipalib/plugins/internal.py:846
 msgid "Not a valid network address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:827
+#: ipalib/plugins/internal.py:847
 msgid "Parse error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:828
+#: ipalib/plugins/internal.py:848
 #, python-brace-format
 msgid "'${port}' is not a valid port"
 msgstr ""
 
-#: ipalib/plugins/internal.py:829
+#: ipalib/plugins/internal.py:849
 msgid "Required field"
 msgstr ""
 
-#: ipalib/plugins/internal.py:830
+#: ipalib/plugins/internal.py:850
 msgid "Unsupported value"
 msgstr ""
 
-#: ipalib/plugins/internal.py:835
+#: ipalib/plugins/internal.py:855
 msgid "Dict of I18N messages"
 msgstr ""
 
@@ -9371,7 +9536,7 @@ msgstr ""
 msgid "Reset Kerberos ticket policy to the default values."
 msgstr ""
 
-#: ipalib/plugins/migration.py:40
+#: ipalib/plugins/migration.py:45
 msgid ""
 "\n"
 "Migration to IPA\n"
@@ -9469,236 +9634,236 @@ msgid ""
 "updated.\n"
 msgstr ""
 
-#: ipalib/plugins/migration.py:137
+#: ipalib/plugins/migration.py:142
 #, python-format
 msgid ""
 "Kerberos principal %s already exists. Use 'ipa user-mod' to set it manually."
 msgstr ""
 
-#: ipalib/plugins/migration.py:138
+#: ipalib/plugins/migration.py:143
 #, python-format
 msgid ""
 "Unable to determine if Kerberos principal %s already exists. Use 'ipa user-"
 "mod' to set it manually."
 msgstr ""
 
-#: ipalib/plugins/migration.py:139
+#: ipalib/plugins/migration.py:144
 msgid ""
 "Failed to add user to the default group. Use 'ipa group-add-member' to add "
 "manually."
 msgstr ""
 
-#: ipalib/plugins/migration.py:140
+#: ipalib/plugins/migration.py:145
 msgid "Migration of LDAP search reference is not supported."
 msgstr ""
 
-#: ipalib/plugins/migration.py:141
+#: ipalib/plugins/migration.py:146
 msgid "Malformed DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:161
+#: ipalib/plugins/migration.py:166
 #, python-format
 msgid "%(user)s is not a POSIX user"
 msgstr ""
 
-#: ipalib/plugins/migration.py:427
+#: ipalib/plugins/migration.py:432
 msgid ""
 ". Check GID of the existing group. Use --group-overwrite-gid option to "
 "overwrite the GID"
 msgstr ""
 
-#: ipalib/plugins/migration.py:442
+#: ipalib/plugins/migration.py:447
 msgid "Invalid LDAP URI."
 msgstr ""
 
-#: ipalib/plugins/migration.py:448
+#: ipalib/plugins/migration.py:453
 msgid "Migrate users and groups from DS to IPA."
 msgstr ""
 
-#: ipalib/plugins/migration.py:495
+#: ipalib/plugins/migration.py:500
 msgid "LDAP URI"
 msgstr ""
 
-#: ipalib/plugins/migration.py:496
+#: ipalib/plugins/migration.py:501
 msgid "LDAP URI of DS server to migrate from"
 msgstr ""
 
-#: ipalib/plugins/migration.py:502
+#: ipalib/plugins/migration.py:507
 msgid "bind password"
 msgstr ""
 
-#: ipalib/plugins/migration.py:509
+#: ipalib/plugins/migration.py:514
 msgid "Bind DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:515
+#: ipalib/plugins/migration.py:520
 msgid "User container"
 msgstr ""
 
-#: ipalib/plugins/migration.py:516
+#: ipalib/plugins/migration.py:521
 msgid "DN of container for users in DS relative to base DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:522
+#: ipalib/plugins/migration.py:527
 msgid "Group container"
 msgstr ""
 
-#: ipalib/plugins/migration.py:523
+#: ipalib/plugins/migration.py:528
 msgid "DN of container for groups in DS relative to base DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:529
+#: ipalib/plugins/migration.py:534
 msgid "User object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:530
+#: ipalib/plugins/migration.py:535
 msgid "Objectclasses used to search for user entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:537
+#: ipalib/plugins/migration.py:542
 msgid "Group object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:538
+#: ipalib/plugins/migration.py:543
 msgid "Objectclasses used to search for group entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:545
+#: ipalib/plugins/migration.py:550
 msgid "Ignore user object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:546
+#: ipalib/plugins/migration.py:551
 msgid "Objectclasses to be ignored for user entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:553
+#: ipalib/plugins/migration.py:558
 msgid "Ignore user attribute"
 msgstr ""
 
-#: ipalib/plugins/migration.py:554
+#: ipalib/plugins/migration.py:559
 msgid "Attributes to be ignored for user entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:561
+#: ipalib/plugins/migration.py:566
 msgid "Ignore group object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:562
+#: ipalib/plugins/migration.py:567
 msgid "Objectclasses to be ignored for group entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:569
+#: ipalib/plugins/migration.py:574
 msgid "Ignore group attribute"
 msgstr ""
 
-#: ipalib/plugins/migration.py:570
+#: ipalib/plugins/migration.py:575
 msgid "Attributes to be ignored for group entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:577
+#: ipalib/plugins/migration.py:582
 msgid "Overwrite GID"
 msgstr ""
 
-#: ipalib/plugins/migration.py:578
+#: ipalib/plugins/migration.py:583
 msgid ""
 "When migrating a group already existing in IPA domain overwrite the group "
 "GID and report as success"
 msgstr ""
 
-#: ipalib/plugins/migration.py:583
+#: ipalib/plugins/migration.py:588
 msgid "LDAP schema"
 msgstr ""
 
-#: ipalib/plugins/migration.py:584
+#: ipalib/plugins/migration.py:589
 msgid ""
 "The schema used on the LDAP server. Supported values are RFC2307 and "
 "RFC2307bis. The default is RFC2307bis"
 msgstr ""
 
-#: ipalib/plugins/migration.py:590
+#: ipalib/plugins/migration.py:595
 msgid "Continue"
 msgstr ""
 
-#: ipalib/plugins/migration.py:591
+#: ipalib/plugins/migration.py:596
 msgid ""
 "Continuous operation mode. Errors are reported but the process continues"
 msgstr ""
 
-#: ipalib/plugins/migration.py:596
+#: ipalib/plugins/migration.py:601
 msgid "Base DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:597
+#: ipalib/plugins/migration.py:602
 msgid "Base DN on remote LDAP server"
 msgstr ""
 
-#: ipalib/plugins/migration.py:601
+#: ipalib/plugins/migration.py:606
 msgid "Ignore compat plugin"
 msgstr ""
 
-#: ipalib/plugins/migration.py:602
+#: ipalib/plugins/migration.py:607
 msgid "Allows migration despite the usage of compat plugin"
 msgstr ""
 
-#: ipalib/plugins/migration.py:607
+#: ipalib/plugins/migration.py:612
 msgid "CA certificate"
 msgstr ""
 
-#: ipalib/plugins/migration.py:608
+#: ipalib/plugins/migration.py:613
 msgid "Load CA certificate of LDAP server from FILE"
 msgstr ""
 
-#: ipalib/plugins/migration.py:613
+#: ipalib/plugins/migration.py:618
 msgid "Add to default group"
 msgstr ""
 
-#: ipalib/plugins/migration.py:614
+#: ipalib/plugins/migration.py:619
 msgid "Add migrated users without a group to a default group (default: true)"
 msgstr ""
 
-#: ipalib/plugins/migration.py:621
+#: ipalib/plugins/migration.py:626
 msgid "Search scope"
 msgstr ""
 
-#: ipalib/plugins/migration.py:622
+#: ipalib/plugins/migration.py:627
 msgid ""
 "LDAP search scope for users and groups: base, onelevel, or subtree. Defaults "
 "to onelevel"
 msgstr ""
 
-#: ipalib/plugins/migration.py:633
+#: ipalib/plugins/migration.py:638
 msgid "Lists of objects migrated; categorized by type."
 msgstr ""
 
-#: ipalib/plugins/migration.py:637
+#: ipalib/plugins/migration.py:642
 msgid "Lists of objects that could not be migrated; categorized by type."
 msgstr ""
 
-#: ipalib/plugins/migration.py:641
+#: ipalib/plugins/migration.py:646
 msgid "False if migration mode was disabled."
 msgstr ""
 
-#: ipalib/plugins/migration.py:645
+#: ipalib/plugins/migration.py:650
 msgid "False if migration fails because the compatibility plug-in is enabled."
 msgstr ""
 
-#: ipalib/plugins/migration.py:649
+#: ipalib/plugins/migration.py:654
 #, python-format
 msgid "%s to exclude from migration"
 msgstr ""
 
-#: ipalib/plugins/migration.py:651
+#: ipalib/plugins/migration.py:656
 msgid ""
 "search results for objects to be migrated\n"
 "have been truncated by the server;\n"
 "migration process might be incomplete\n"
 msgstr ""
 
-#: ipalib/plugins/migration.py:656
+#: ipalib/plugins/migration.py:661
 msgid "Migration mode is disabled. Use 'ipa config-mod' to enable it."
 msgstr ""
 
-#: ipalib/plugins/migration.py:659
+#: ipalib/plugins/migration.py:664
 msgid ""
 "Passwords have been migrated in pre-hashed format.\n"
 "IPA is unable to generate Kerberos keys unless provided\n"
@@ -9707,14 +9872,14 @@ msgid ""
 "can use their Kerberos accounts."
 msgstr ""
 
-#: ipalib/plugins/migration.py:748
+#: ipalib/plugins/migration.py:753
 #, python-format
 msgid ""
 "%(container)s LDAP search did not return any result (search base: "
 "%(search_base)s, objectclass: %(objectclass)s)"
 msgstr ""
 
-#: ipalib/plugins/migration.py:780 ipalib/plugins/user.py:471
+#: ipalib/plugins/migration.py:785 ipalib/plugins/user.py:487
 msgid "Default group for new users not found"
 msgstr ""
 
@@ -9761,7 +9926,7 @@ msgstr[1] ""
 msgid "Number of plugins loaded"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:29
+#: ipalib/plugins/netgroup.py:33
 msgid ""
 "\n"
 "Netgroups\n"
@@ -9787,100 +9952,100 @@ msgid ""
 "   ipa netgroup-del admins\n"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:71
+#: ipalib/plugins/netgroup.py:75
 msgid "Member Host"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:85
+#: ipalib/plugins/netgroup.py:89
 msgid "netgroup"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:86
+#: ipalib/plugins/netgroup.py:90
 msgid "netgroups"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:175
+#: ipalib/plugins/netgroup.py:183
 msgid "Netgroups"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:176
+#: ipalib/plugins/netgroup.py:184
 msgid "Netgroup"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:183
+#: ipalib/plugins/netgroup.py:191
 msgid "Netgroup name"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:190
+#: ipalib/plugins/netgroup.py:198
 msgid "Netgroup description"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:196
+#: ipalib/plugins/netgroup.py:204
 msgid "NIS domain name"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:201
+#: ipalib/plugins/netgroup.py:209
 msgid "IPA unique ID"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:222
+#: ipalib/plugins/netgroup.py:230
 msgid "Add a new netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:225
+#: ipalib/plugins/netgroup.py:233
 #, python-format
 msgid "Added netgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:227
+#: ipalib/plugins/netgroup.py:235
 #, python-format
 msgid ""
 "hostgroup with name \"%s\" already exists. Hostgroups and netgroups share a "
 "common namespace"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:258
+#: ipalib/plugins/netgroup.py:266
 msgid "Delete a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:260
+#: ipalib/plugins/netgroup.py:268
 #, python-format
 msgid "Deleted netgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:266
+#: ipalib/plugins/netgroup.py:274
 msgid "Modify a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:269
+#: ipalib/plugins/netgroup.py:277
 #, python-format
 msgid "Modified netgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:287
+#: ipalib/plugins/netgroup.py:295
 msgid "Search for a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:292
+#: ipalib/plugins/netgroup.py:300
 #, python-format
 msgid "%(count)d netgroup matched"
 msgid_plural "%(count)d netgroups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/netgroup.py:302
+#: ipalib/plugins/netgroup.py:310
 msgid "search for managed groups"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:324
+#: ipalib/plugins/netgroup.py:332
 msgid "Display information about a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:331
+#: ipalib/plugins/netgroup.py:339
 msgid "Add members to a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:353
+#: ipalib/plugins/netgroup.py:361
 msgid "Remove members from a netgroup."
 msgstr ""
 
@@ -9912,8 +10077,8 @@ msgid ""
 "   ipa hotpconfig-mod --hotp-sync-window=50\n"
 msgstr ""
 
-#: ipalib/plugins/otpconfig.py:52 ipalib/plugins/otptoken.py:64
-#: ipalib/plugins/otptoken_yubikey.py:47
+#: ipalib/plugins/otpconfig.py:52 ipalib/plugins/otptoken.py:68
+#: ipalib/plugins/otptoken_yubikey.py:51
 msgid "One time password commands"
 msgstr ""
 
@@ -9965,40 +10130,40 @@ msgstr ""
 msgid "Show the current OTP configuration."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:39
+#: ipalib/plugins/otptoken.py:43
 msgid ""
 "\n"
 "OTP Tokens\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:41
+#: ipalib/plugins/otptoken.py:45
 msgid ""
 "\n"
 "Manage OTP tokens.\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:43
+#: ipalib/plugins/otptoken.py:47
 msgid ""
 "\n"
 "IPA supports the use of OTP tokens for multi-factor authentication. This\n"
 "code enables the management of OTP tokens.\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:48
+#: ipalib/plugins/otptoken.py:52
 msgid ""
 "\n"
 " Add a new token:\n"
 "   ipa otptoken-add --type=totp --owner=jdoe --desc=\"My soft token\"\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:51
+#: ipalib/plugins/otptoken.py:55
 msgid ""
 "\n"
 " Examine the token:\n"
 "   ipa otptoken-show a93db710-a31a-4639-8647-f15b2c70b78a\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:54
+#: ipalib/plugins/otptoken.py:58
 msgid ""
 "\n"
 " Change the vendor:\n"
@@ -10006,246 +10171,250 @@ msgid ""
 "\"\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:57
+#: ipalib/plugins/otptoken.py:61
 msgid ""
 "\n"
 " Delete a token:\n"
 "   ipa otptoken-del a93db710-a31a-4639-8647-f15b2c70b78a\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:132
+#: ipalib/plugins/otptoken.py:136
 msgid "OTP token"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:133
+#: ipalib/plugins/otptoken.py:137
 msgid "OTP tokens"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:149
+#: ipalib/plugins/otptoken.py:153
 msgid "OTP Tokens"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:150
+#: ipalib/plugins/otptoken.py:154
 msgid "OTP Token"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:155 ipalib/plugins/otptoken_yubikey.py:57
+#: ipalib/plugins/otptoken.py:159 ipalib/plugins/otptoken_yubikey.py:61
 msgid "Unique ID"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:161
+#: ipalib/plugins/otptoken.py:165
 msgid "Type of the token"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:170
+#: ipalib/plugins/otptoken.py:174
 msgid "Token description (informational only)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:174
+#: ipalib/plugins/otptoken.py:178
 msgid "Owner"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:175
+#: ipalib/plugins/otptoken.py:179
 msgid "Assigned user of the token (default: self)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:179
+#: ipalib/plugins/otptoken.py:183
 msgid "Assigned manager of the token (default: self)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:185
+#: ipalib/plugins/otptoken.py:189
 msgid "Mark the token as disabled (default: false)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:189
+#: ipalib/plugins/otptoken.py:193
 msgid "Validity start"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:190
+#: ipalib/plugins/otptoken.py:194
 msgid "First date/time the token can be used"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:194
+#: ipalib/plugins/otptoken.py:198
 msgid "Validity end"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:195
+#: ipalib/plugins/otptoken.py:199
 msgid "Last date/time the token can be used"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:199
+#: ipalib/plugins/otptoken.py:203
 msgid "Vendor"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:200
+#: ipalib/plugins/otptoken.py:204
 msgid "Token vendor name (informational only)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:204
+#: ipalib/plugins/otptoken.py:208
 msgid "Model"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:205
+#: ipalib/plugins/otptoken.py:209
 msgid "Token model (informational only)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:209
+#: ipalib/plugins/otptoken.py:213
 msgid "Serial"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:210
+#: ipalib/plugins/otptoken.py:214
 msgid "Token serial (informational only)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:215
+#: ipalib/plugins/otptoken.py:219
 msgid "Token secret (Base32; default: random)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:223
+#: ipalib/plugins/otptoken.py:227
 msgid "Token hash algorithm"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:231
+#: ipalib/plugins/otptoken.py:235
 msgid "Digits"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:232
+#: ipalib/plugins/otptoken.py:236
 msgid "Number of digits each token code will have"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:240
+#: ipalib/plugins/otptoken.py:244
 msgid "Clock offset"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:241
+#: ipalib/plugins/otptoken.py:245
 msgid "TOTP token / FreeIPA server time difference"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:248
+#: ipalib/plugins/otptoken.py:252
 msgid "Clock interval"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:249
+#: ipalib/plugins/otptoken.py:253
 msgid "Length of TOTP token code validity"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:257
+#: ipalib/plugins/otptoken.py:261
 msgid "Counter"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:258
+#: ipalib/plugins/otptoken.py:262
 msgid "Initial counter for the HOTP token"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:269
+#: ipalib/plugins/otptoken.py:273
 msgid "Add a new OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:270
+#: ipalib/plugins/otptoken.py:274
 #, python-format
 msgid "Added OTP token \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:273
+#: ipalib/plugins/otptoken.py:277
 msgid "(deprecated)"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:274
+#: ipalib/plugins/otptoken.py:278
 msgid "Do not display QR code"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:278
+#: ipalib/plugins/otptoken.py:282
 msgid "URI"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:367
+#: ipalib/plugins/otptoken.py:371
 msgid "Delete an OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:368
+#: ipalib/plugins/otptoken.py:372
 #, python-format
 msgid "Deleted OTP token \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:373
+#: ipalib/plugins/otptoken.py:377
 msgid "Modify a OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:374
+#: ipalib/plugins/otptoken.py:378
 #, python-format
 msgid "Modified OTP token \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:422
+#: ipalib/plugins/otptoken.py:426
 msgid "Search for OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:423
+#: ipalib/plugins/otptoken.py:427
 #, python-format
 msgid "%(count)d OTP token matched"
 msgid_plural "%(count)d OTP tokens matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/otptoken.py:451
+#: ipalib/plugins/otptoken.py:455
 msgid "Display information about an OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:464
+#: ipalib/plugins/otptoken.py:468
 msgid "Add users that can manage this token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:516
+#: ipalib/plugins/otptoken.py:474
+msgid "Remove users that can manage this token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:501
 msgid "Synchronize an OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:521
+#: ipalib/plugins/otptoken.py:506
 msgid "User ID"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:523
+#: ipalib/plugins/otptoken.py:508
 msgid "First Code"
 msgstr ""
 
-#: ipalib/plugins/otptoken.py:524
+#: ipalib/plugins/otptoken.py:509
 msgid "Second Code"
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:31
+#: ipalib/plugins/otptoken_yubikey.py:35
 msgid ""
 "\n"
 "YubiKey Tokens\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:33
+#: ipalib/plugins/otptoken_yubikey.py:37
 msgid ""
 "\n"
 "Manage YubiKey tokens.\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:35
+#: ipalib/plugins/otptoken_yubikey.py:39
 msgid ""
 "\n"
 "This code is an extension to the otptoken plugin and provides support for\n"
 "reading/writing YubiKey tokens directly.\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:40
+#: ipalib/plugins/otptoken_yubikey.py:44
 msgid ""
 "\n"
 " Add a new token:\n"
 "   ipa otptoken-add-yubikey --owner=jdoe --desc=\"My YubiKey\"\n"
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:52
+#: ipalib/plugins/otptoken_yubikey.py:56
 msgid "Add a new YubiKey OTP token."
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:65
+#: ipalib/plugins/otptoken_yubikey.py:69
 msgid "YubiKey slot"
 msgstr ""
 
-#: ipalib/plugins/otptoken_yubikey.py:101
+#: ipalib/plugins/otptoken_yubikey.py:105
 msgid "No free YubiKey slot!"
 msgstr ""
 
@@ -10283,17 +10452,18 @@ msgstr ""
 msgid "Changed password for \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/passwd.py:127
+#: ipalib/plugins/passwd.py:127 ipalib/plugins/vault.py:861
+#: ipalib/plugins/vault.py:880
 msgid "Invalid credentials"
 msgstr ""
 
-#: ipalib/plugins/permission.py:33
+#: ipalib/plugins/permission.py:39
 msgid ""
 "\n"
 "Permissions\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:35
+#: ipalib/plugins/permission.py:41
 msgid ""
 "\n"
 "A permission enables fine-grained delegation of rights. A permission is\n"
@@ -10303,13 +10473,13 @@ msgid ""
 "user, modifying a group, etc.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:41
+#: ipalib/plugins/permission.py:47
 msgid ""
 "\n"
 "A permission may not contain other permissions.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:43
+#: ipalib/plugins/permission.py:49
 msgid ""
 "\n"
 "* A permission grants access to read, write, add, delete, read, search,\n"
@@ -10319,7 +10489,7 @@ msgid ""
 "* A role grants a set of privileges to users, groups, hosts or hostgroups.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:49
+#: ipalib/plugins/permission.py:55
 msgid ""
 "\n"
 "A permission is made up of a number of different parts:\n"
@@ -10329,7 +10499,7 @@ msgid ""
 "3. The rights granted by the permission.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:55
+#: ipalib/plugins/permission.py:61
 msgid ""
 "\n"
 "Rights define what operations are allowed, and may be one or more\n"
@@ -10343,7 +10513,7 @@ msgid ""
 "7. all - all permissions are granted\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:65
+#: ipalib/plugins/permission.py:71
 msgid ""
 "\n"
 "Note the distinction between attributes and entries. The permissions are\n"
@@ -10351,7 +10521,7 @@ msgid ""
 "be editable.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:69
+#: ipalib/plugins/permission.py:75
 msgid ""
 "\n"
 "There are a number of allowed targets:\n"
@@ -10361,7 +10531,7 @@ msgid ""
 "to\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:74
+#: ipalib/plugins/permission.py:80
 msgid ""
 "\n"
 "Additionally, there are the following convenience options.\n"
@@ -10373,13 +10543,13 @@ msgid ""
 "   the rights to manage group membership); sets target.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:81
+#: ipalib/plugins/permission.py:87
 msgid ""
 "\n"
 "Managed permissions\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:83
+#: ipalib/plugins/permission.py:89
 msgid ""
 "\n"
 "Permissions that come with IPA by default can be so-called \"managed\"\n"
@@ -10387,21 +10557,21 @@ msgid ""
 "but the administrator can add/remove individual attributes to/from the set.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:87
+#: ipalib/plugins/permission.py:93
 msgid ""
 "\n"
 "Deleting or renaming a managed permission, as well as changing its target,\n"
 "is not allowed.\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:92
+#: ipalib/plugins/permission.py:98
 msgid ""
 "\n"
 " Add a permission that grants the creation of users:\n"
 "   ipa permission-add --type=user --permissions=add \"Add Users\"\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:95
+#: ipalib/plugins/permission.py:101
 msgid ""
 "\n"
 " Add a permission that grants the ability to manage group membership:\n"
@@ -10409,295 +10579,295 @@ msgid ""
 "\"Manage Group Members\"\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:126
+#: ipalib/plugins/permission.py:132
 msgid "must be enclosed in parentheses"
 msgstr ""
 
-#: ipalib/plugins/permission.py:145
+#: ipalib/plugins/permission.py:151
 #, python-format
 msgid "\"%s\" is not an object type"
 msgstr ""
 
-#: ipalib/plugins/permission.py:147 ipalib/plugins/permission.py:875
+#: ipalib/plugins/permission.py:153 ipalib/plugins/permission.py:881
 #, python-format
 msgid "\"%s\" is not a valid permission type"
 msgstr ""
 
-#: ipalib/plugins/permission.py:168
+#: ipalib/plugins/permission.py:174
 msgid "permission"
 msgstr ""
 
-#: ipalib/plugins/permission.py:169
+#: ipalib/plugins/permission.py:175
 msgid "permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:224
+#: ipalib/plugins/permission.py:230
 msgid "Permission name"
 msgstr ""
 
-#: ipalib/plugins/permission.py:234
+#: ipalib/plugins/permission.py:240
 msgid "Granted rights"
 msgstr ""
 
-#: ipalib/plugins/permission.py:235
+#: ipalib/plugins/permission.py:241
 msgid "Rights to grant (read, search, compare, write, add, delete, all)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:242
+#: ipalib/plugins/permission.py:248
 msgid "Effective attributes"
 msgstr ""
 
-#: ipalib/plugins/permission.py:243
+#: ipalib/plugins/permission.py:249
 msgid "All attributes to which the permission applies"
 msgstr ""
 
-#: ipalib/plugins/permission.py:248
+#: ipalib/plugins/permission.py:254
 msgid "Included attributes"
 msgstr ""
 
-#: ipalib/plugins/permission.py:249
+#: ipalib/plugins/permission.py:255
 msgid "User-specified attributes to which the permission applies"
 msgstr ""
 
-#: ipalib/plugins/permission.py:254
+#: ipalib/plugins/permission.py:260
 msgid "Excluded attributes"
 msgstr ""
 
-#: ipalib/plugins/permission.py:255
+#: ipalib/plugins/permission.py:261
 msgid ""
 "User-specified attributes to which the permission explicitly does not apply"
 msgstr ""
 
-#: ipalib/plugins/permission.py:261
+#: ipalib/plugins/permission.py:267
 msgid "Default attributes"
 msgstr ""
 
-#: ipalib/plugins/permission.py:262
+#: ipalib/plugins/permission.py:268
 msgid "Attributes to which the permission applies by default"
 msgstr ""
 
-#: ipalib/plugins/permission.py:268 ipalib/plugins/permission.py:269
+#: ipalib/plugins/permission.py:274 ipalib/plugins/permission.py:275
 msgid "Bind rule type"
 msgstr ""
 
-#: ipalib/plugins/permission.py:279
+#: ipalib/plugins/permission.py:285
 msgid "Subtree to apply permissions to"
 msgstr ""
 
-#: ipalib/plugins/permission.py:285 ipalib/plugins/permission.py:286
+#: ipalib/plugins/permission.py:291 ipalib/plugins/permission.py:292
 msgid "Extra target filter"
 msgstr ""
 
-#: ipalib/plugins/permission.py:292
+#: ipalib/plugins/permission.py:298
 msgid "Raw target filter"
 msgstr ""
 
-#: ipalib/plugins/permission.py:293
+#: ipalib/plugins/permission.py:299
 msgid "All target filters, including those implied by type and memberof"
 msgstr ""
 
-#: ipalib/plugins/permission.py:300
+#: ipalib/plugins/permission.py:306
 msgid "Target DN"
 msgstr ""
 
-#: ipalib/plugins/permission.py:301
+#: ipalib/plugins/permission.py:307
 msgid ""
 "Optional DN to apply the permission to (must be in the subtree, but may not "
 "yet exist)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:308
+#: ipalib/plugins/permission.py:314
 msgid "Target DN subtree"
 msgstr ""
 
-#: ipalib/plugins/permission.py:309
+#: ipalib/plugins/permission.py:315
 msgid ""
 "Optional DN subtree where an entry can be moved to (must be in the subtree, "
 "but may not yet exist)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:316
+#: ipalib/plugins/permission.py:322
 msgid "Origin DN subtree"
 msgstr ""
 
-#: ipalib/plugins/permission.py:317
+#: ipalib/plugins/permission.py:323
 msgid ""
 "Optional DN subtree from where an entry can be moved (must be in the "
 "subtree, but may not yet exist)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:322
+#: ipalib/plugins/permission.py:328
 msgid "Member of group"
 msgstr ""
 
-#: ipalib/plugins/permission.py:323
+#: ipalib/plugins/permission.py:329
 msgid "Target members of a group (sets memberOf targetfilter)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:328
+#: ipalib/plugins/permission.py:334
 msgid "User group to apply permissions to (sets target)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:334
+#: ipalib/plugins/permission.py:340
 msgid "Type of IPA object (sets subtree and objectClass targetfilter)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:340
+#: ipalib/plugins/permission.py:346
 #, python-format
 msgid "Deprecated; use %s"
 msgstr ""
 
-#: ipalib/plugins/permission.py:351
+#: ipalib/plugins/permission.py:357
 #, python-format
 msgid "Permission with unknown flag %s may not be modified or removed"
 msgstr ""
 
-#: ipalib/plugins/permission.py:355
+#: ipalib/plugins/permission.py:361
 msgid "A SYSTEM permission may not be modified or removed"
 msgstr ""
 
-#: ipalib/plugins/permission.py:603
+#: ipalib/plugins/permission.py:609
 #, python-format
 msgid "Entry %s not found"
 msgstr ""
 
-#: ipalib/plugins/permission.py:694
+#: ipalib/plugins/permission.py:700
 #, python-format
 msgid "The ACI for permission %(name)s was not found in %(dn)s "
 msgstr ""
 
-#: ipalib/plugins/permission.py:798
+#: ipalib/plugins/permission.py:804
 msgid ""
 "cannot specify full target filter and extra target filter simultaneously"
 msgstr ""
 
-#: ipalib/plugins/permission.py:821
+#: ipalib/plugins/permission.py:827
 #, python-format
 msgid "option was renamed; use %s"
 msgstr ""
 
-#: ipalib/plugins/permission.py:825
+#: ipalib/plugins/permission.py:831
 #, python-format
 msgid "Cannot use %(old_name)s with %(new_name)s"
 msgstr ""
 
-#: ipalib/plugins/permission.py:839 ipalib/plugins/permission.py:854
+#: ipalib/plugins/permission.py:845 ipalib/plugins/permission.py:860
 #, python-format
 msgid "%s: group not found"
 msgstr ""
 
-#: ipalib/plugins/permission.py:849
+#: ipalib/plugins/permission.py:855
 msgid "target and targetgroup are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/permission.py:870
+#: ipalib/plugins/permission.py:876
 msgid "subtree and type are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/permission.py:906
+#: ipalib/plugins/permission.py:912
 msgid "Bad search filter"
 msgstr ""
 
-#: ipalib/plugins/permission.py:916
+#: ipalib/plugins/permission.py:922
 #, python-format
 msgid "Entry %s does not exist"
 msgstr ""
 
-#: ipalib/plugins/permission.py:925
+#: ipalib/plugins/permission.py:931
 msgid ""
 "there must be at least one target entry specifier (e.g. target, "
 "targetfilter, attrs)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:935
+#: ipalib/plugins/permission.py:941
 msgid "Add a system permission without an ACI (internal command)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:937 ipalib/plugins/permission.py:968
+#: ipalib/plugins/permission.py:943 ipalib/plugins/permission.py:974
 #, python-format
 msgid "Added permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/permission.py:943
+#: ipalib/plugins/permission.py:949
 msgid "Permission flags"
 msgstr ""
 
-#: ipalib/plugins/permission.py:966
+#: ipalib/plugins/permission.py:972
 msgid "Add a new permission."
 msgstr ""
 
-#: ipalib/plugins/permission.py:994
+#: ipalib/plugins/permission.py:1000
 msgid "attrs and included attributes are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1026
+#: ipalib/plugins/permission.py:1032
 #, python-format
 msgid "Cannot store permission ACI to %s"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1035
+#: ipalib/plugins/permission.py:1041
 msgid "Delete a permission."
 msgstr ""
 
-#: ipalib/plugins/permission.py:1037
+#: ipalib/plugins/permission.py:1043
 #, python-format
 msgid "Deleted permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/permission.py:1043
+#: ipalib/plugins/permission.py:1049
 msgid "force delete of SYSTEM permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1057
+#: ipalib/plugins/permission.py:1063
 msgid "cannot delete managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1063
+#: ipalib/plugins/permission.py:1069
 #, python-format
 msgid "ACI of permission %s was not found"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1070
+#: ipalib/plugins/permission.py:1076
 msgid "Modify a permission."
 msgstr ""
 
-#: ipalib/plugins/permission.py:1072
+#: ipalib/plugins/permission.py:1078
 #, python-format
 msgid "Modified permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/permission.py:1106
+#: ipalib/plugins/permission.py:1112
 msgid "cannot rename managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1113 ipalib/plugins/permission.py:1117
+#: ipalib/plugins/permission.py:1119 ipalib/plugins/permission.py:1123
 msgid "not modifiable on managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1124
+#: ipalib/plugins/permission.py:1130
 msgid "only available on managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1131 ipalib/plugins/permission.py:1251
+#: ipalib/plugins/permission.py:1137 ipalib/plugins/permission.py:1257
 msgid "attrs and included/excluded attributes are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1142
+#: ipalib/plugins/permission.py:1148
 msgid "cannot set bindtype for a permission that is assigned to a privilege"
 msgstr ""
 
-#: ipalib/plugins/permission.py:1236
+#: ipalib/plugins/permission.py:1242
 msgid "Search for permissions."
 msgstr ""
 
-#: ipalib/plugins/permission.py:1239
+#: ipalib/plugins/permission.py:1245
 #, python-format
 msgid "%(count)d permission matched"
 msgid_plural "%(count)d permissions matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/permission.py:1366
+#: ipalib/plugins/permission.py:1371
 msgid "Display information about a permission."
 msgstr ""
 
@@ -10797,100 +10967,100 @@ msgid ""
 "See role and permission for additional information.\n"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:54
+#: ipalib/plugins/privilege.py:63
+#, python-format
+msgid ""
+"cannot add permission \"%(perm)s\" with bindtype \"%(bindtype)s\" to a "
+"privilege"
+msgstr ""
+
+#: ipalib/plugins/privilege.py:79
 msgid "privilege"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:55
+#: ipalib/plugins/privilege.py:80
 msgid "privileges"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:96
+#: ipalib/plugins/privilege.py:121
 msgid "Privileges"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:97
+#: ipalib/plugins/privilege.py:122
 msgid "Privilege"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:102
+#: ipalib/plugins/privilege.py:127
 msgid "Privilege name"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:108
+#: ipalib/plugins/privilege.py:133
 msgid "Privilege description"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:115
+#: ipalib/plugins/privilege.py:140
 msgid "Add a new privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:117
+#: ipalib/plugins/privilege.py:142
 #, python-format
 msgid "Added privilege \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/privilege.py:122
+#: ipalib/plugins/privilege.py:147
 msgid "Delete a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:124
+#: ipalib/plugins/privilege.py:149
 #, python-format
 msgid "Deleted privilege \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/privilege.py:129
+#: ipalib/plugins/privilege.py:154
 msgid "Modify a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:131
+#: ipalib/plugins/privilege.py:156
 #, python-format
 msgid "Modified privilege \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/privilege.py:136
+#: ipalib/plugins/privilege.py:161
 msgid "Search for privileges."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:139
+#: ipalib/plugins/privilege.py:164
 #, python-format
 msgid "%(count)d privilege matched"
 msgid_plural "%(count)d privileges matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/privilege.py:145
+#: ipalib/plugins/privilege.py:170
 msgid "Display information about a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:150
+#: ipalib/plugins/privilege.py:175
 msgid "Add members to a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:165
+#: ipalib/plugins/privilege.py:190
 msgid "Add permissions to a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:180
-msgid "Number of permissions added"
-msgstr ""
-
 #: ipalib/plugins/privilege.py:205
-#, python-format
-msgid ""
-"cannot add permission \"%(perm)s\" with bindtype \"%(bindtype)s\" to a "
-"privilege"
+msgid "Number of permissions added"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:218
+#: ipalib/plugins/privilege.py:219
 msgid "Remove permissions from a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:235
+#: ipalib/plugins/privilege.py:236
 msgid "Number of permissions removed"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:31
+#: ipalib/plugins/pwpolicy.py:36
 msgid ""
 "\n"
 "Password policy\n"
@@ -10936,132 +11106,132 @@ msgid ""
 "   ipa pwpolicy-mod --minclasses=2 localadmins\n"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:130
+#: ipalib/plugins/pwpolicy.py:135
 #, python-format
 msgid "priority must be a unique value (%(prio)d already used by %(gname)s)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:219
+#: ipalib/plugins/pwpolicy.py:224
 msgid "password policy"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:220
+#: ipalib/plugins/pwpolicy.py:225
 msgid "password policies"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:289
+#: ipalib/plugins/pwpolicy.py:294
 msgid "Max failures"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:290
+#: ipalib/plugins/pwpolicy.py:295
 msgid "Consecutive failures before lockout"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:295
+#: ipalib/plugins/pwpolicy.py:300
 msgid "Failure reset interval"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:296
+#: ipalib/plugins/pwpolicy.py:301
 msgid "Period after which failure count will be reset (seconds)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:301
+#: ipalib/plugins/pwpolicy.py:306
 msgid "Lockout duration"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:302
+#: ipalib/plugins/pwpolicy.py:307
 msgid "Period for which lockout is enforced (seconds)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:307
+#: ipalib/plugins/pwpolicy.py:312
 msgid "Password Policies"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:313
+#: ipalib/plugins/pwpolicy.py:318
 msgid "Group"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:314
+#: ipalib/plugins/pwpolicy.py:319
 msgid "Manage password policy for specific group"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:319
+#: ipalib/plugins/pwpolicy.py:324
 msgid "Max lifetime (days)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:320
+#: ipalib/plugins/pwpolicy.py:325
 msgid "Maximum password lifetime (in days)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:326
+#: ipalib/plugins/pwpolicy.py:331
 msgid "Min lifetime (hours)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:327
+#: ipalib/plugins/pwpolicy.py:332
 msgid "Minimum password lifetime (in hours)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:332
+#: ipalib/plugins/pwpolicy.py:337
 msgid "History size"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:333
+#: ipalib/plugins/pwpolicy.py:338
 msgid "Password history size"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:338
+#: ipalib/plugins/pwpolicy.py:343
 msgid "Character classes"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:339
+#: ipalib/plugins/pwpolicy.py:344
 msgid "Minimum number of character classes"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:345
+#: ipalib/plugins/pwpolicy.py:350
 msgid "Min length"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:346
+#: ipalib/plugins/pwpolicy.py:351
 msgid "Minimum length of password"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:352
+#: ipalib/plugins/pwpolicy.py:357
 msgid "Priority of the policy (higher number means lower priority"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:406
+#: ipalib/plugins/pwpolicy.py:411
 msgid "Maximum password life must be greater than minimum."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:424
+#: ipalib/plugins/pwpolicy.py:429
 msgid "Add a new group password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:450
+#: ipalib/plugins/pwpolicy.py:455
 msgid "Delete a group password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:462
+#: ipalib/plugins/pwpolicy.py:467
 msgid "cannot delete global password policy"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:477
+#: ipalib/plugins/pwpolicy.py:482
 msgid "Modify a group password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:488
+#: ipalib/plugins/pwpolicy.py:493
 msgid "priority cannot be set on global policy"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:520
+#: ipalib/plugins/pwpolicy.py:525
 msgid "Display information about password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:525
+#: ipalib/plugins/pwpolicy.py:530
 msgid "Display effective policy for a specific user"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:549
+#: ipalib/plugins/pwpolicy.py:554
 msgid "Search for group password policies."
 msgstr ""
 
@@ -11230,7 +11400,7 @@ msgstr[1] ""
 msgid "Display information about a RADIUS proxy server."
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:30
+#: ipalib/plugins/realmdomains.py:35
 msgid ""
 "\n"
 "Realm domains\n"
@@ -11253,47 +11423,62 @@ msgid ""
 "   ipa realmdomains-mod --del-domain=olddomain.com\n"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:70
+#: ipalib/plugins/realmdomains.py:75
 msgid "Realm domains"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:106
+#: ipalib/plugins/realmdomains.py:111
 msgid "Add domain"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:112
+#: ipalib/plugins/realmdomains.py:117
 msgid "Delete domain"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:120
+#: ipalib/plugins/realmdomains.py:125
 msgid "Modify realm domains."
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:125
+#: ipalib/plugins/realmdomains.py:130
 msgid "Force adding domain even if not in DNS"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:138
+#: ipalib/plugins/realmdomains.py:155
+#, python-format
 msgid ""
-"you cannot specify the --domain option together with --add-domain or --del-"
-"domain"
+"DNS zone for each realmdomain must contain SOA or NS records. No records "
+"found for: %s"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:140 ipalib/plugins/realmdomains.py:160
-msgid "cannot delete domain of IPA server"
+#: ipalib/plugins/realmdomains.py:181
+#, python-format
+msgid "The following domains do not belong to this realm: %(domains)s"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:145
+#: ipalib/plugins/realmdomains.py:196
 #, python-format
-msgid "no SOA or NS records found for domains: %s"
+msgid ""
+"The realm of the folllowing domains could not be detected: %(domains)s. If "
+"these are domains that belong to the this realm, please create a _kerberos "
+"TXT record containing \"%(realm)s\" in each of them."
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:154
-#, python-format
-msgid "no SOA or NS records found for domain %s"
+#: ipalib/plugins/realmdomains.py:219
+msgid ""
+"The --domain option cannot be used together with --add-domain or --del-"
+"domain. Use --domain to specify the whole realm domain list explicitly, to "
+"add/remove individual domains, use --add-domain/del-domain."
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:217
+#: ipalib/plugins/realmdomains.py:230
+msgid "IPA server domain cannot be omitted"
+msgstr ""
+
+#: ipalib/plugins/realmdomains.py:252
+msgid "IPA server domain cannot be deleted"
+msgstr ""
+
+#: ipalib/plugins/realmdomains.py:339
 msgid "Display the list of realm domains."
 msgstr ""
 
@@ -11737,63 +11922,63 @@ msgstr ""
 msgid "servers"
 msgstr ""
 
-#: ipalib/plugins/server.py:45
+#: ipalib/plugins/server.py:46
 msgid "IPA Servers"
 msgstr ""
 
-#: ipalib/plugins/server.py:52
+#: ipalib/plugins/server.py:59
 msgid "Server name"
 msgstr ""
 
-#: ipalib/plugins/server.py:53
+#: ipalib/plugins/server.py:60
 msgid "IPA server hostname"
 msgstr ""
 
-#: ipalib/plugins/server.py:58
-msgid "Managed suffix"
+#: ipalib/plugins/server.py:68
+msgid "Managed suffixes"
 msgstr ""
 
-#: ipalib/plugins/server.py:63
+#: ipalib/plugins/server.py:74
 msgid "Min domain level"
 msgstr ""
 
-#: ipalib/plugins/server.py:64
+#: ipalib/plugins/server.py:75
 msgid "Minimum domain level"
 msgstr ""
 
-#: ipalib/plugins/server.py:70
+#: ipalib/plugins/server.py:81
 msgid "Max domain level"
 msgstr ""
 
-#: ipalib/plugins/server.py:71
+#: ipalib/plugins/server.py:82
 msgid "Maximum domain level"
 msgstr ""
 
-#: ipalib/plugins/server.py:79
+#: ipalib/plugins/server.py:106
 msgid "Search for IPA servers."
 msgstr ""
 
-#: ipalib/plugins/server.py:82
+#: ipalib/plugins/server.py:109
 #, python-format
 msgid "%(count)d IPA server matched"
 msgid_plural "%(count)d IPA servers matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/server.py:89
+#: ipalib/plugins/server.py:176
 msgid "Show IPA server."
 msgstr ""
 
-#: ipalib/plugins/server.py:94
+#: ipalib/plugins/server.py:188
 msgid "Delete IPA server."
 msgstr ""
 
-#: ipalib/plugins/server.py:96
+#: ipalib/plugins/server.py:190
 #, python-format
 msgid "Deleted IPA server \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:36
+#: ipalib/plugins/service.py:41
 msgid ""
 "\n"
 "Services\n"
@@ -11851,14 +12036,14 @@ msgid ""
 "   ipa cert-request --principal=HTTP/web.example.com example.csr\n"
 msgstr ""
 
-#: ipalib/plugins/service.py:89
+#: ipalib/plugins/service.py:94
 msgid ""
 "\n"
 " Allow user to create a keytab:\n"
 "   ipa service-allow-create-keytab HTTP/web.example.com --users=tuser1\n"
 msgstr ""
 
-#: ipalib/plugins/service.py:92
+#: ipalib/plugins/service.py:97
 msgid ""
 "\n"
 " Generate and retrieve a keytab for an IPA service:\n"
@@ -11867,160 +12052,178 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/service.py:169
+#: ipalib/plugins/service.py:174
 msgid "Requires pre-authentication"
 msgstr ""
 
-#: ipalib/plugins/service.py:170
+#: ipalib/plugins/service.py:175
 msgid "Pre-authentication is required for the service"
 msgstr ""
 
-#: ipalib/plugins/service.py:175
+#: ipalib/plugins/service.py:180
 msgid "Trusted for delegation"
 msgstr ""
 
-#: ipalib/plugins/service.py:176
+#: ipalib/plugins/service.py:181
 msgid "Client credentials may be delegated to the service"
 msgstr ""
 
-#: ipalib/plugins/service.py:196
+#: ipalib/plugins/service.py:201
 msgid "unable to determine service"
 msgstr ""
 
-#: ipalib/plugins/service.py:200
+#: ipalib/plugins/service.py:205
 msgid "blank service"
 msgstr ""
 
-#: ipalib/plugins/service.py:208
+#: ipalib/plugins/service.py:213
 msgid "unable to determine realm"
 msgstr ""
 
-#: ipalib/plugins/service.py:225
+#: ipalib/plugins/service.py:230
 msgid "missing service"
 msgstr ""
 
-#: ipalib/plugins/service.py:287
+#: ipalib/plugins/service.py:318
 msgid "This principal is required by the IPA master"
 msgstr ""
 
-#: ipalib/plugins/service.py:360
+#: ipalib/plugins/service.py:391
 msgid "service"
 msgstr ""
 
-#: ipalib/plugins/service.py:361
+#: ipalib/plugins/service.py:392
 msgid "services"
 msgstr ""
 
-#: ipalib/plugins/service.py:447
+#: ipalib/plugins/service.py:477
 msgid "Service principal"
 msgstr ""
 
-#: ipalib/plugins/service.py:459
+#: ipalib/plugins/service.py:489
 msgid "PAC type"
 msgstr ""
 
-#: ipalib/plugins/service.py:460
+#: ipalib/plugins/service.py:490
 msgid ""
 "Override default list of supported PAC types. Use 'NONE' to disable PAC "
 "support for this service, e.g. this might be necessary for NFS services."
 msgstr ""
 
-#: ipalib/plugins/service.py:481
+#: ipalib/plugins/service.py:511
 msgid "NONE value cannot be combined with other PAC types"
 msgstr ""
 
-#: ipalib/plugins/service.py:490
+#: ipalib/plugins/service.py:520
 msgid "Add a new IPA new service."
 msgstr ""
 
-#: ipalib/plugins/service.py:492
+#: ipalib/plugins/service.py:522
 #, python-format
 msgid "Added service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:498
+#: ipalib/plugins/service.py:528
 msgid "force principal name even if not in DNS"
 msgstr ""
 
-#: ipalib/plugins/service.py:512
+#: ipalib/plugins/service.py:542
 #, python-format
 msgid "The host '%s' does not exist to add a service to."
 msgstr ""
 
-#: ipalib/plugins/service.py:553
+#: ipalib/plugins/service.py:583
 msgid "Delete an IPA service."
 msgstr ""
 
-#: ipalib/plugins/service.py:555
+#: ipalib/plugins/service.py:585
 #, python-format
 msgid "Deleted service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:596
+#: ipalib/plugins/service.py:607
 msgid "Modify an existing IPA service."
 msgstr ""
 
-#: ipalib/plugins/service.py:598
+#: ipalib/plugins/service.py:609
 #, python-format
 msgid "Modified service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:666
+#: ipalib/plugins/service.py:656
 msgid "Search for IPA services."
 msgstr ""
 
-#: ipalib/plugins/service.py:669
+#: ipalib/plugins/service.py:659
 #, python-format
 msgid "%(count)d service matched"
 msgid_plural "%(count)d services matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/service.py:704
+#: ipalib/plugins/service.py:694
 msgid "Display information about an IPA service."
 msgstr ""
 
-#: ipalib/plugins/service.py:746
+#: ipalib/plugins/service.py:736
 msgid "Add hosts that can manage this service."
 msgstr ""
 
-#: ipalib/plugins/service.py:755
+#: ipalib/plugins/service.py:745
 msgid "Remove hosts that can manage this service."
 msgstr ""
 
-#: ipalib/plugins/service.py:763
+#: ipalib/plugins/service.py:753
 msgid ""
 "Allow users, groups, hosts or host groups to retrieve a keytab of this "
 "service."
 msgstr ""
 
-#: ipalib/plugins/service.py:782
+#: ipalib/plugins/service.py:772
 msgid ""
 "Disallow users, groups, hosts or host groups to retrieve a keytab of this "
 "service."
 msgstr ""
 
-#: ipalib/plugins/service.py:800
+#: ipalib/plugins/service.py:790
 msgid ""
 "Allow users, groups, hosts or host groups to create a keytab of this service."
 msgstr ""
 
-#: ipalib/plugins/service.py:819
+#: ipalib/plugins/service.py:809
 msgid ""
 "Disallow users, groups, hosts or host groups to create a keytab of this "
 "service."
 msgstr ""
 
-#: ipalib/plugins/service.py:837
+#: ipalib/plugins/service.py:827
 msgid "Disable the Kerberos key and SSL certificate of a service."
 msgstr ""
 
-#: ipalib/plugins/service.py:840
+#: ipalib/plugins/service.py:830
 #, python-format
 msgid "Disabled service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:12
+#: ipalib/plugins/service.py:871
+msgid "Add new certificates to a service"
+msgstr ""
+
+#: ipalib/plugins/service.py:872
+#, python-format
+msgid "Added certificates to service principal \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/service.py:878
+msgid "Remove certificates from a service"
+msgstr ""
+
+#: ipalib/plugins/service.py:879
+#, python-format
+msgid "Removed certificates from service principal \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/servicedelegation.py:17
 msgid ""
 "\n"
 "Service Constrained Delegation\n"
@@ -12078,167 +12281,167 @@ msgid ""
 "\n"
 "It is strongly discouraged to modify the delegations that ship with\n"
 "IPA, ipa-http-delegation and its targets ipa-cifs-delegation-targets and\n"
-"ipa-ldap-delegation-targets. Incorrect changes can remove the ablity\n"
+"ipa-ldap-delegation-targets. Incorrect changes can remove the ability\n"
 "to delegate, causing the framework to stop functioning.\n"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:88
+#: ipalib/plugins/servicedelegation.py:93
 msgid "Allowed Target"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:92
+#: ipalib/plugins/servicedelegation.py:97
 msgid "Allowed to Impersonate"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:96
+#: ipalib/plugins/servicedelegation.py:101
 msgid "Member principals"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:104
+#: ipalib/plugins/servicedelegation.py:109
 msgid "Failed targets"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:168
+#: ipalib/plugins/servicedelegation.py:173
 msgid "Add target to a named service delegation."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:249
+#: ipalib/plugins/servicedelegation.py:254
 msgid "Remove member from a named service delegation."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:342
-#: ipalib/plugins/servicedelegation.py:375
+#: ipalib/plugins/servicedelegation.py:347
+#: ipalib/plugins/servicedelegation.py:380
 msgid "service delegation rule"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:343
+#: ipalib/plugins/servicedelegation.py:348
 msgid "service delegation rules"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:354
+#: ipalib/plugins/servicedelegation.py:359
 msgid "Service delegation rules"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:355
+#: ipalib/plugins/servicedelegation.py:360
 msgid "Service delegation rule"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:360
+#: ipalib/plugins/servicedelegation.py:365
 msgid "Create a new service delegation rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:362
+#: ipalib/plugins/servicedelegation.py:367
 #, python-format
 msgid "Added service delegation rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:367
+#: ipalib/plugins/servicedelegation.py:372
 msgid "Delete service delegation."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:369
+#: ipalib/plugins/servicedelegation.py:374
 #, python-format
 msgid "Deleted service delegation \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:377
+#: ipalib/plugins/servicedelegation.py:382
 msgid "privileged service delegation rule"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:384
+#: ipalib/plugins/servicedelegation.py:389
 msgid "Search for service delegations rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:389
+#: ipalib/plugins/servicedelegation.py:394
 #, python-format
 msgid "%(count)d service delegation rule matched"
 msgid_plural "%(count)d service delegation rules matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/servicedelegation.py:396
+#: ipalib/plugins/servicedelegation.py:401
 msgid "Display information about a named service delegation rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:403
+#: ipalib/plugins/servicedelegation.py:408
 msgid "Add member to a named service delegation rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:412
+#: ipalib/plugins/servicedelegation.py:417
 msgid "Remove member from a named service delegation rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:420
+#: ipalib/plugins/servicedelegation.py:425
 msgid "Add target to a named service delegation rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:431
+#: ipalib/plugins/servicedelegation.py:436
 msgid "Remove target from a named service delegation rule."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:441
-#: ipalib/plugins/servicedelegation.py:470
+#: ipalib/plugins/servicedelegation.py:446
+#: ipalib/plugins/servicedelegation.py:475
 msgid "service delegation target"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:442
+#: ipalib/plugins/servicedelegation.py:447
 msgid "service delegation targets"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:449
+#: ipalib/plugins/servicedelegation.py:454
 msgid "Service delegation targets"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:450
+#: ipalib/plugins/servicedelegation.py:455
 msgid "Service delegation target"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:455
+#: ipalib/plugins/servicedelegation.py:460
 msgid "Create a new service delegation target."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:457
+#: ipalib/plugins/servicedelegation.py:462
 #, python-format
 msgid "Added service delegation target \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:462
+#: ipalib/plugins/servicedelegation.py:467
 msgid "Delete service delegation target."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:464
+#: ipalib/plugins/servicedelegation.py:469
 #, python-format
 msgid "Deleted service delegation target \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:472
+#: ipalib/plugins/servicedelegation.py:477
 msgid "privileged service delegation target"
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:479
+#: ipalib/plugins/servicedelegation.py:484
 msgid "Search for service delegation target."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:484
+#: ipalib/plugins/servicedelegation.py:489
 #, python-format
 msgid "%(count)d service delegation target matched"
 msgid_plural "%(count)d service delegation targets matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/servicedelegation.py:518
+#: ipalib/plugins/servicedelegation.py:523
 msgid "Display information about a named service delegation target."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:525
+#: ipalib/plugins/servicedelegation.py:530
 msgid "Add member to a named service delegation target."
 msgstr ""
 
-#: ipalib/plugins/servicedelegation.py:534
+#: ipalib/plugins/servicedelegation.py:539
 msgid "Remove member from a named service delegation target."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:48
+#: ipalib/plugins/stageuser.py:53
 msgid ""
 "\n"
 "Stageusers\n"
@@ -12287,103 +12490,112 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:110
+#: ipalib/plugins/stageuser.py:115
 msgid "Stage Users"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:111
+#: ipalib/plugins/stageuser.py:116
 msgid "Stage User"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:112
+#: ipalib/plugins/stageuser.py:117
 msgid "stage user"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:113
+#: ipalib/plugins/stageuser.py:118
 msgid "stage users"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:248
+#: ipalib/plugins/stageuser.py:263
 msgid "Add a new stage user."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:250
+#: ipalib/plugins/stageuser.py:265
 #, python-format
 msgid "Added stage user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:256
+#: ipalib/plugins/stageuser.py:271
 msgid "Create Stage user in from a delete user"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:268
+#: ipalib/plugins/stageuser.py:282
 msgid "givenname is required"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:271
+#: ipalib/plugins/stageuser.py:285
 msgid "sn is required"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:412
+#: ipalib/plugins/stageuser.py:397
 msgid "Delete a stage user."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:414
+#: ipalib/plugins/stageuser.py:399
 #, python-format
 msgid "Deleted stage user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:418
+#: ipalib/plugins/stageuser.py:403
 msgid "Modify a stage user."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:420
+#: ipalib/plugins/stageuser.py:405
 #, python-format
 msgid "Modified stage user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:439
+#: ipalib/plugins/stageuser.py:424
 msgid "Search for stage users."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:469 ipalib/plugins/user.py:711
+#: ipalib/plugins/stageuser.py:447 ipalib/plugins/user.py:755
 #, python-format
 msgid "%(count)d user matched"
 msgid_plural "%(count)d users matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/stageuser.py:474
+#: ipalib/plugins/stageuser.py:452
 msgid "Display information about a stage user."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:486
+#: ipalib/plugins/stageuser.py:464
 msgid "Activate a stage user."
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:488
+#: ipalib/plugins/stageuser.py:466
 #, python-format
 msgid "Activate a stage user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:501
+#: ipalib/plugins/stageuser.py:479
 msgid "Entry RDN is not 'uid'"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:507
-msgid "Entry has no 'cn'"
+#: ipalib/plugins/stageuser.py:485
+#, python-format
+msgid "Entry has no '%(attribute)s'"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:677
+#: ipalib/plugins/stageuser.py:656
 #, python-format
-msgid "Active user %(user)s already exists"
+msgid "active user with name \"%(user)s\" already exists"
 msgstr ""
 
-#: ipalib/plugins/stageuser.py:738
+#: ipalib/plugins/stageuser.py:717
 #, python-format
 msgid "Stage user %s activated"
 msgstr ""
 
+#: ipalib/plugins/stageuser.py:723
+msgid "Add a manager to the stage user entry"
+msgstr ""
+
+#: ipalib/plugins/stageuser.py:728
+msgid "Remove a manager to the stage user entry"
+msgstr ""
+
 #: ipalib/plugins/sudocmd.py:30
 msgid ""
 "\n"
@@ -12555,13 +12767,13 @@ msgstr ""
 msgid "Remove members from Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:38
+#: ipalib/plugins/sudorule.py:42
 msgid ""
 "\n"
 "Sudo Rules\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:40
+#: ipalib/plugins/sudorule.py:44
 msgid ""
 "\n"
 "Sudo (su \"do\") allows a system administrator to delegate authority to\n"
@@ -12570,7 +12782,7 @@ msgid ""
 "commands and their arguments.\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:45
+#: ipalib/plugins/sudorule.py:49
 msgid ""
 "\n"
 "FreeIPA provides a means to configure the various aspects of Sudo:\n"
@@ -12585,7 +12797,7 @@ msgid ""
 "   Options: The various Sudoers Options that can modify Sudo's behavior.\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:54
+#: ipalib/plugins/sudorule.py:58
 msgid ""
 "\n"
 "An order can be added to a sudorule to control the order in which they\n"
@@ -12593,14 +12805,14 @@ msgid ""
 "must be unique.\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:58
+#: ipalib/plugins/sudorule.py:62
 msgid ""
 "\n"
 "FreeIPA provides a designated binddn to use with Sudo located at:\n"
 "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:61
+#: ipalib/plugins/sudorule.py:65
 msgid ""
 "\n"
 "To enable the binddn run the following command to set the password:\n"
@@ -12609,14 +12821,14 @@ msgid ""
 "dc=com\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:68
+#: ipalib/plugins/sudorule.py:72
 msgid ""
 "\n"
 " Create a new rule:\n"
 "   ipa sudorule-add readfiles\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:71
+#: ipalib/plugins/sudorule.py:75
 msgid ""
 "\n"
 " Add sudo command object and add it as allowed command in the rule:\n"
@@ -12624,360 +12836,360 @@ msgid ""
 "   ipa sudorule-add-allow-command readfiles --sudocmds /usr/bin/less\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:75
+#: ipalib/plugins/sudorule.py:79
 msgid ""
 "\n"
 " Add a host to the rule:\n"
 "   ipa sudorule-add-host readfiles --hosts server.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:78
+#: ipalib/plugins/sudorule.py:82
 msgid ""
 "\n"
 " Add a user to the rule:\n"
 "   ipa sudorule-add-user readfiles --users jsmith\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:81
+#: ipalib/plugins/sudorule.py:85
 msgid ""
 "\n"
 " Add a special Sudo rule for default Sudo server configuration:\n"
 "   ipa sudorule-add defaults\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:84
+#: ipalib/plugins/sudorule.py:88
 msgid ""
 "\n"
 " Set a default Sudo option:\n"
 "   ipa sudorule-add-option defaults --sudooption '!authenticate'\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:91
+#: ipalib/plugins/sudorule.py:95
 msgid "Commands for controlling sudo configuration"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:97
+#: ipalib/plugins/sudorule.py:101
 msgid "this option has been deprecated."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:101
+#: ipalib/plugins/sudorule.py:105
 msgid "host masks of allowed hosts"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:124
+#: ipalib/plugins/sudorule.py:128
 msgid "sudo rule"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:125
+#: ipalib/plugins/sudorule.py:129
 msgid "sudo rules"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:212
+#: ipalib/plugins/sudorule.py:216
 msgid "Sudo Rules"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:213
+#: ipalib/plugins/sudorule.py:217
 msgid "Sudo Rule"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:243
+#: ipalib/plugins/sudorule.py:247
 msgid "Command category"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:244
+#: ipalib/plugins/sudorule.py:248
 msgid "Command category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:249
+#: ipalib/plugins/sudorule.py:253
 msgid "RunAs User category"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:250
+#: ipalib/plugins/sudorule.py:254
 msgid "RunAs User category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:255
+#: ipalib/plugins/sudorule.py:259
 msgid "RunAs Group category"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:256
+#: ipalib/plugins/sudorule.py:260
 msgid "RunAs Group category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:261
+#: ipalib/plugins/sudorule.py:265
 msgid "Sudo order"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:262
+#: ipalib/plugins/sudorule.py:266
 msgid "integer to order the Sudo rules"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:276
+#: ipalib/plugins/sudorule.py:280
 msgid "External User"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:277
+#: ipalib/plugins/sudorule.py:281
 msgid "External User the rule applies to (sudorule-find only)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:289
+#: ipalib/plugins/sudorule.py:293
 msgid "Host Masks"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:295
+#: ipalib/plugins/sudorule.py:299
 msgid "Sudo Allow Commands"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:299
+#: ipalib/plugins/sudorule.py:303
 msgid "Sudo Deny Commands"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:303
+#: ipalib/plugins/sudorule.py:307
 msgid "Sudo Allow Command Groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:307
+#: ipalib/plugins/sudorule.py:311
 msgid "Sudo Deny Command Groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:311
+#: ipalib/plugins/sudorule.py:315
 msgid "RunAs Users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:312
+#: ipalib/plugins/sudorule.py:316
 msgid "Run as a user"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:316
+#: ipalib/plugins/sudorule.py:320
 msgid "Groups of RunAs Users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:317
+#: ipalib/plugins/sudorule.py:321
 msgid "Run as any user within a specified group"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:322
+#: ipalib/plugins/sudorule.py:326
 msgid "RunAs External User"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:323
+#: ipalib/plugins/sudorule.py:327
 msgid "External User the commands can run as (sudorule-find only)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:327
+#: ipalib/plugins/sudorule.py:331
 msgid "External Groups of RunAs Users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:328
+#: ipalib/plugins/sudorule.py:332
 msgid "External Groups of users that the command can run as"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:332
+#: ipalib/plugins/sudorule.py:336
 msgid "RunAs Groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:333
+#: ipalib/plugins/sudorule.py:337
 msgid "Run with the gid of a specified POSIX group"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:338
+#: ipalib/plugins/sudorule.py:342
 msgid "RunAs External Group"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:339
+#: ipalib/plugins/sudorule.py:343
 msgid "External Group the commands can run as (sudorule-find only)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:342 ipalib/plugins/sudorule.py:915
-#: ipalib/plugins/sudorule.py:968
+#: ipalib/plugins/sudorule.py:346 ipalib/plugins/sudorule.py:920
+#: ipalib/plugins/sudorule.py:973
 msgid "Sudo Option"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:348
+#: ipalib/plugins/sudorule.py:352
 #, python-format
 msgid "order must be a unique value (%(order)d already used by %(rule)s)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:370
+#: ipalib/plugins/sudorule.py:374
 msgid "Create new Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:379
+#: ipalib/plugins/sudorule.py:383
 #, python-format
 msgid "Added Sudo Rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:384
+#: ipalib/plugins/sudorule.py:388
 msgid "Delete Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:386
+#: ipalib/plugins/sudorule.py:390
 #, python-format
 msgid "Deleted Sudo Rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:391
+#: ipalib/plugins/sudorule.py:395
 msgid "Modify Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:393
+#: ipalib/plugins/sudorule.py:397
 #, python-format
 msgid "Modified Sudo Rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:413
+#: ipalib/plugins/sudorule.py:417
 #, python-format
 msgid ""
 "%(type)s category cannot be set to 'all' while there are allowed %(objects)s"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:419 ipalib/plugins/user.py:127
+#: ipalib/plugins/sudorule.py:423 ipalib/plugins/user.py:135
 msgid "user"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:419 ipalib/plugins/user.py:128
+#: ipalib/plugins/sudorule.py:423 ipalib/plugins/user.py:136
 msgid "users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:429
+#: ipalib/plugins/sudorule.py:433
 msgid "command"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:429
+#: ipalib/plugins/sudorule.py:433
 msgid "commands"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:435
+#: ipalib/plugins/sudorule.py:439
 msgid "runAs user"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:435
+#: ipalib/plugins/sudorule.py:439
 msgid "runAs users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:440
+#: ipalib/plugins/sudorule.py:444
 msgid "group runAs"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:440
+#: ipalib/plugins/sudorule.py:444
 msgid "runAs groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:458
+#: ipalib/plugins/sudorule.py:462
 msgid "Search for Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:461
+#: ipalib/plugins/sudorule.py:465
 #, python-format
 msgid "%(count)d Sudo Rule matched"
 msgid_plural "%(count)d Sudo Rules matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/sudorule.py:467
+#: ipalib/plugins/sudorule.py:471
 msgid "Display Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:472
+#: ipalib/plugins/sudorule.py:476
 msgid "Enable a Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:493
+#: ipalib/plugins/sudorule.py:497
 #, python-format
 msgid "Enabled Sudo Rule \"%s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:498
+#: ipalib/plugins/sudorule.py:502
 msgid "Disable a Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:519
+#: ipalib/plugins/sudorule.py:523
 #, python-format
 msgid "Disabled Sudo Rule \"%s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:524 ipalib/plugins/sudorule.py:555
+#: ipalib/plugins/sudorule.py:528 ipalib/plugins/sudorule.py:559
 msgid "Add commands and sudo command groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:539
+#: ipalib/plugins/sudorule.py:543
 msgid "commands cannot be added when command category='all'"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:547 ipalib/plugins/sudorule.py:567
+#: ipalib/plugins/sudorule.py:551 ipalib/plugins/sudorule.py:571
 msgid "Remove commands and sudo command groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:575
+#: ipalib/plugins/sudorule.py:579
 msgid "Add users and groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:607
+#: ipalib/plugins/sudorule.py:611
 msgid "Remove users and groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:625
+#: ipalib/plugins/sudorule.py:629
 msgid "Add hosts and hostgroups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:682
+#: ipalib/plugins/sudorule.py:686
 msgid "Remove hosts and hostgroups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:727
+#: ipalib/plugins/sudorule.py:732
 msgid "Add users and groups for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:750 ipalib/plugins/sudorule.py:863
+#: ipalib/plugins/sudorule.py:755 ipalib/plugins/sudorule.py:868
 msgid "users cannot be added when runAs user or runAs group category='all'"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:757
+#: ipalib/plugins/sudorule.py:762
 #, python-format
 msgid "RunAsUser does not accept '%(name)s' as a user name"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:765
+#: ipalib/plugins/sudorule.py:770
 #, python-format
 msgid "RunAsUser does not accept '%(name)s' as a group name"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:804
+#: ipalib/plugins/sudorule.py:809
 msgid "Remove users and groups for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:842
+#: ipalib/plugins/sudorule.py:847
 msgid "Add group for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:870
+#: ipalib/plugins/sudorule.py:875
 #, python-format
 msgid "RunAsGroup does not accept '%(name)s' as a group name"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:890
+#: ipalib/plugins/sudorule.py:895
 msgid "Remove group for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:909
+#: ipalib/plugins/sudorule.py:914
 msgid "Add an option to the Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:953
+#: ipalib/plugins/sudorule.py:958
 #, python-format
 msgid "Added option \"%(option)s\" to Sudo Rule \"%(rule)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:962
+#: ipalib/plugins/sudorule.py:967
 msgid "Remove an option from Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:1011
+#: ipalib/plugins/sudorule.py:1016
 #, python-format
 msgid "Removed option \"%(option)s\" from Sudo Rule \"%(rule)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:16
+#: ipalib/plugins/topology.py:22
 msgid ""
 "\n"
 "Topology\n"
@@ -12987,269 +13199,313 @@ msgid ""
 "Requires minimum domain level 1.\n"
 msgstr ""
 
-#: ipalib/plugins/topology.py:33
+#: ipalib/plugins/topology.py:37
 #, python-brace-format
 msgid "Topology management requires minimum domain level {0} "
 msgstr ""
 
-#: ipalib/plugins/topology.py:45
+#: ipalib/plugins/topology.py:49
 msgid "segment"
 msgstr ""
 
-#: ipalib/plugins/topology.py:46
+#: ipalib/plugins/topology.py:50
 msgid "segments"
 msgstr ""
 
-#: ipalib/plugins/topology.py:60
+#: ipalib/plugins/topology.py:64
 msgid "Topology Segments"
 msgstr ""
 
-#: ipalib/plugins/topology.py:61
+#: ipalib/plugins/topology.py:65
 msgid "Topology Segment"
 msgstr ""
 
-#: ipalib/plugins/topology.py:69
+#: ipalib/plugins/topology.py:73
 msgid "Segment name"
 msgstr ""
 
-#: ipalib/plugins/topology.py:73
+#: ipalib/plugins/topology.py:77
 msgid "Arbitrary string identifying the segment"
 msgstr ""
 
-#: ipalib/plugins/topology.py:81
+#: ipalib/plugins/topology.py:85
 msgid "Left node"
 msgstr ""
 
-#: ipalib/plugins/topology.py:83
+#: ipalib/plugins/topology.py:87
 msgid "Left replication node - an IPA server"
 msgstr ""
 
-#: ipalib/plugins/topology.py:92
+#: ipalib/plugins/topology.py:96
 msgid "Right node"
 msgstr ""
 
-#: ipalib/plugins/topology.py:94
+#: ipalib/plugins/topology.py:98
 msgid "Right replication node - an IPA server"
 msgstr ""
 
-#: ipalib/plugins/topology.py:100
+#: ipalib/plugins/topology.py:104
 msgid "Connectivity"
 msgstr ""
 
-#: ipalib/plugins/topology.py:103
+#: ipalib/plugins/topology.py:108
 msgid "Direction of replication between left and right replication node"
 msgstr ""
 
-#: ipalib/plugins/topology.py:110
+#: ipalib/plugins/topology.py:115
 msgid "Attributes to strip"
 msgstr ""
 
-#: ipalib/plugins/topology.py:112
+#: ipalib/plugins/topology.py:117
 msgid ""
 "A space separated list of attributes which are removed from replication "
 "updates."
 msgstr ""
 
-#: ipalib/plugins/topology.py:119
+#: ipalib/plugins/topology.py:124
 msgid ""
 "Attributes that are not replicated to a consumer server during a fractional "
 "update. E.g., `(objectclass=*) $ EXCLUDE accountlockout memberof"
 msgstr ""
 
-#: ipalib/plugins/topology.py:126
+#: ipalib/plugins/topology.py:131
 msgid "Attributes for total update"
 msgstr ""
 
-#: ipalib/plugins/topology.py:127
+#: ipalib/plugins/topology.py:132
 msgid ""
 "Attributes that are not replicated to a consumer server during a total "
 "update. E.g. (objectclass=*) $ EXCLUDE accountlockout"
 msgstr ""
 
-#: ipalib/plugins/topology.py:134
+#: ipalib/plugins/topology.py:139
 msgid "Session timeout"
 msgstr ""
 
-#: ipalib/plugins/topology.py:136
+#: ipalib/plugins/topology.py:141
 msgid ""
 "Number of seconds outbound LDAP operations waits for a response from the "
 "remote replica before timing out and failing"
 msgstr ""
 
-#: ipalib/plugins/topology.py:143
+#: ipalib/plugins/topology.py:148
 msgid "Replication agreement enabled"
 msgstr ""
 
-#: ipalib/plugins/topology.py:144
+#: ipalib/plugins/topology.py:149
 msgid ""
 "Whether a replication agreement is active, meaning whether replication is "
 "occurring per that agreement"
 msgstr ""
 
-#: ipalib/plugins/topology.py:164
+#: ipalib/plugins/topology.py:170
 #, python-format
 msgid "left node is not a topology node: %(leftnode)s"
 msgstr ""
 
-#: ipalib/plugins/topology.py:171
+#: ipalib/plugins/topology.py:177
 #, python-format
 msgid "right node is not a topology node: %(rightnode)s"
 msgstr ""
 
-#: ipalib/plugins/topology.py:188
+#: ipalib/plugins/topology.py:194
 msgid "left node and right node must not be the same"
 msgstr ""
 
-#: ipalib/plugins/topology.py:194
+#: ipalib/plugins/topology.py:200
 msgid "Search for topology segments."
 msgstr ""
 
-#: ipalib/plugins/topology.py:197
+#: ipalib/plugins/topology.py:203
 #, python-format
 msgid "%(count)d segment matched"
 msgid_plural "%(count)d segments matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/topology.py:204
+#: ipalib/plugins/topology.py:210
 msgid "Add a new segment."
 msgstr ""
 
-#: ipalib/plugins/topology.py:206
+#: ipalib/plugins/topology.py:212
 #, python-format
 msgid "Added segment \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:217
+#: ipalib/plugins/topology.py:223
 msgid "Delete a segment."
 msgstr ""
 
-#: ipalib/plugins/topology.py:219
+#: ipalib/plugins/topology.py:225
 #, python-format
 msgid "Deleted segment \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:229
+#: ipalib/plugins/topology.py:235
 msgid "Modify a segment."
 msgstr ""
 
-#: ipalib/plugins/topology.py:231
+#: ipalib/plugins/topology.py:237
 #, python-format
 msgid "Modified segment \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:242
+#: ipalib/plugins/topology.py:248
 msgid ""
 "Request a full re-initialization of the node retrieving data from the other "
 "node."
 msgstr ""
 
-#: ipalib/plugins/topology.py:246
+#: ipalib/plugins/topology.py:252
 #, python-format
 msgid "%(value)s"
 msgstr ""
 
-#: ipalib/plugins/topology.py:251
+#: ipalib/plugins/topology.py:257
 msgid "Initialize left node"
 msgstr ""
 
-#: ipalib/plugins/topology.py:256
+#: ipalib/plugins/topology.py:262
 msgid "Initialize right node"
 msgstr ""
 
-#: ipalib/plugins/topology.py:261
+#: ipalib/plugins/topology.py:267
 msgid "Stop already started refresh of chosen node(s)"
 msgstr ""
 
-#: ipalib/plugins/topology.py:282
+#: ipalib/plugins/topology.py:288
 msgid "left or right node has to be specified"
 msgstr ""
 
-#: ipalib/plugins/topology.py:287
+#: ipalib/plugins/topology.py:293
 msgid "only one node can be specified"
 msgstr ""
 
-#: ipalib/plugins/topology.py:291
+#: ipalib/plugins/topology.py:297
 #, python-format
 msgid "Replication refresh for segment: \"%(pkey)s\" requested."
 msgstr ""
 
-#: ipalib/plugins/topology.py:294
+#: ipalib/plugins/topology.py:300
 #, python-format
 msgid "Stopping of replication refresh for segment: \"%(pkey)s\" requested."
 msgstr ""
 
-#: ipalib/plugins/topology.py:315
+#: ipalib/plugins/topology.py:321
 msgid "Display a segment."
 msgstr ""
 
-#: ipalib/plugins/topology.py:324
+#: ipalib/plugins/topology.py:330
 msgid "suffix"
 msgstr ""
 
-#: ipalib/plugins/topology.py:325
-msgid "suffices"
+#: ipalib/plugins/topology.py:331
+msgid "suffixes"
 msgstr ""
 
-#: ipalib/plugins/topology.py:329
-msgid "Topology suffices"
+#: ipalib/plugins/topology.py:335
+msgid "Topology suffixes"
 msgstr ""
 
-#: ipalib/plugins/topology.py:330
+#: ipalib/plugins/topology.py:336
 msgid "Topology suffix"
 msgstr ""
 
-#: ipalib/plugins/topology.py:337
+#: ipalib/plugins/topology.py:343
 msgid "Suffix name"
 msgstr ""
 
-#: ipalib/plugins/topology.py:343
+#: ipalib/plugins/topology.py:349
 msgid "LDAP suffix to be managed"
 msgstr ""
 
-#: ipalib/plugins/topology.py:351
-msgid "Search for topology suffices."
+#: ipalib/plugins/topology.py:357
+msgid "Search for topology suffixes."
 msgstr ""
 
-#: ipalib/plugins/topology.py:354
+#: ipalib/plugins/topology.py:360
 #, python-format
 msgid "%(count)d topology suffix matched"
-msgid_plural "%(count)d topology suffices matched"
+msgid_plural "%(count)d topology suffixes matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/topology.py:361
+#: ipalib/plugins/topology.py:367
 msgid "Delete a topology suffix."
 msgstr ""
 
-#: ipalib/plugins/topology.py:365
+#: ipalib/plugins/topology.py:371
 #, python-format
 msgid "Deleted topology suffix \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:375
+#: ipalib/plugins/topology.py:381
 msgid "Add a new topology suffix to be managed."
 msgstr ""
 
-#: ipalib/plugins/topology.py:379
+#: ipalib/plugins/topology.py:385
 #, python-format
 msgid "Added topology suffix \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:389
+#: ipalib/plugins/topology.py:395
 msgid "Modify a topology suffix."
 msgstr ""
 
-#: ipalib/plugins/topology.py:393
+#: ipalib/plugins/topology.py:399
 #, python-format
 msgid "Modified topology suffix \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/topology.py:403
+#: ipalib/plugins/topology.py:409
 msgid "Show managed suffix."
 msgstr ""
 
-#: ipalib/plugins/trust.py:50
+#: ipalib/plugins/topology.py:414
+msgid ""
+"\n"
+"Verify replication topology for suffix.\n"
+"\n"
+"Checks done:\n"
+"  1. check if a topology is not disconnected. In other words if there are\n"
+"     replication paths between all servers.\n"
+"  2. check if servers don't have more than the recommended number of\n"
+"     replication agreements\n"
+msgstr ""
+
+#: ipalib/plugins/topology.py:463
+#, python-format
+msgid "Replication topology of suffix \"%(suffix)s\" is in order."
+msgstr ""
+
+#: ipalib/plugins/topology.py:466
+#, python-format
+msgid "Replication topology of suffix \"%(suffix)s\" contains errors."
+msgstr ""
+
+#: ipalib/plugins/topology.py:471
+msgid "Topology is disconnected"
+msgstr ""
+
+#: ipalib/plugins/topology.py:473
+#, python-format
+msgid "Server %(srv)s can't contact servers: %(replicas)s"
+msgstr ""
+
+#: ipalib/plugins/topology.py:478
+msgid "Recommended maximum number of agreements per replica exceeded"
+msgstr ""
+
+#: ipalib/plugins/topology.py:481
+msgid "Maximum number of agreements per replica"
+msgstr ""
+
+#: ipalib/plugins/topology.py:485
+#, python-format
+msgid "Server \"%(srv)s\" has %(n)d agreements with servers:"
+msgstr ""
+
+#: ipalib/plugins/trust.py:58
 msgid ""
 "\n"
 "Cross-realm trusts\n"
@@ -13350,72 +13606,103 @@ msgid ""
 "\"\n"
 msgstr ""
 
-#: ipalib/plugins/trust.py:144
+#: ipalib/plugins/trust.py:152
 msgid "Non-Active Directory domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:146
+#: ipalib/plugins/trust.py:154
 msgid "RFC4120-compliant Kerberos realm"
 msgstr ""
 
-#: ipalib/plugins/trust.py:147
+#: ipalib/plugins/trust.py:155
 msgid "Trusting forest"
 msgstr ""
 
-#: ipalib/plugins/trust.py:148
+#: ipalib/plugins/trust.py:156
 msgid "Trusted forest"
 msgstr ""
 
-#: ipalib/plugins/trust.py:149
+#: ipalib/plugins/trust.py:157 ipalib/plugins/trust.py:633
 msgid "Two-way trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:150
+#: ipalib/plugins/trust.py:158
 msgid "Established and verified"
 msgstr ""
 
-#: ipalib/plugins/trust.py:151
+#: ipalib/plugins/trust.py:159
 msgid "Waiting for confirmation by remote side"
 msgstr ""
 
-#: ipalib/plugins/trust.py:152
+#: ipalib/plugins/trust.py:160
 msgid "Unknown"
 msgstr ""
 
-#: ipalib/plugins/trust.py:156
+#: ipalib/plugins/trust.py:164
 msgid "Trust type (ad for Active Directory, default)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:309
+#: ipalib/plugins/trust.py:232
+#, python-format
+msgid ""
+" Alternatively, following servers are capable of running this command: "
+"%(masters)s"
+msgstr ""
+
+#: ipalib/plugins/trust.py:245 ipalib/plugins/trust.py:778
+#: ipalib/plugins/trust.py:794 ipalib/plugins/trust.py:815
+#: ipalib/plugins/trust.py:825 ipalib/plugins/trust.py:951
+#: ipalib/plugins/trust.py:985 ipalib/plugins/trust.py:1594
+msgid "AD Trust setup"
+msgstr ""
+
+#: ipalib/plugins/trust.py:256
+msgid ""
+"Cannot perform the selected command without Samba 4 support installed. Make "
+"sure you have installed server-trust-ad sub-package of IPA."
+msgstr ""
+
+#: ipalib/plugins/trust.py:266
+msgid ""
+"Cannot perform the selected command without Samba 4 instance configured on "
+"this machine. Make sure you have run ipa-adtrust-install on this server."
+msgstr ""
+
+#: ipalib/plugins/trust.py:448
+msgid ""
+"Fetching domains from trusted forest failed. See details in the error_log"
+msgstr ""
+
+#: ipalib/plugins/trust.py:459
 msgid "trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:310
+#: ipalib/plugins/trust.py:460
 msgid "trusts"
 msgstr ""
 
-#: ipalib/plugins/trust.py:347
+#: ipalib/plugins/trust.py:498
 msgid "Trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:352 ipa-client/ipa-rmkeytab.c:176
+#: ipalib/plugins/trust.py:503 ipa-client/ipa-rmkeytab.c:176
 msgid "Realm name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:366
+#: ipalib/plugins/trust.py:517
 msgid "SID blacklist incoming"
 msgstr ""
 
-#: ipalib/plugins/trust.py:371
+#: ipalib/plugins/trust.py:522
 msgid "SID blacklist outgoing"
 msgstr ""
 
-#: ipalib/plugins/trust.py:388
+#: ipalib/plugins/trust.py:539
 #, python-format
 msgid "invalid SID: %(value)s"
 msgstr ""
 
-#: ipalib/plugins/trust.py:410
+#: ipalib/plugins/trust.py:577
 msgid ""
 "\n"
 "Add new trust to use.\n"
@@ -13432,145 +13719,155 @@ msgid ""
 "    "
 msgstr ""
 
-#: ipalib/plugins/trust.py:434
+#: ipalib/plugins/trust.py:601
 msgid "Active Directory domain administrator"
 msgstr ""
 
-#: ipalib/plugins/trust.py:438
+#: ipalib/plugins/trust.py:605
 msgid "Active Directory domain administrator's password"
 msgstr ""
 
-#: ipalib/plugins/trust.py:443
+#: ipalib/plugins/trust.py:610 ipalib/plugins/trust.py:1570
 msgid "Domain controller for the Active Directory domain (optional)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:447
+#: ipalib/plugins/trust.py:614
 msgid "Shared secret for the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:452
+#: ipalib/plugins/trust.py:619
 msgid "First Posix ID of the range reserved for the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:456
+#: ipalib/plugins/trust.py:623
 msgid "Size of the ID range reserved for the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:461
+#: ipalib/plugins/trust.py:628
 #, python-brace-format
 msgid "Type of trusted domain ID range, one of {vals}"
 msgstr ""
 
-#: ipalib/plugins/trust.py:467
+#: ipalib/plugins/trust.py:635
+msgid ""
+"Establish bi-directional trust. By default trust is inbound one-way only."
+msgstr ""
+
+#: ipalib/plugins/trust.py:640
 #, python-format
 msgid "Added Active Directory trust for realm \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:468
+#: ipalib/plugins/trust.py:641
 #, python-format
 msgid "Re-established trust to domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:543 ipalib/plugins/trust.py:585
-#: ipalib/plugins/trust.py:605 ipalib/plugins/trust.py:615
-#: ipalib/plugins/trust.py:737 ipalib/plugins/trust.py:770
-#: ipalib/plugins/trust.py:1348 ipalib/plugins/trust.py:1360
-msgid "AD Trust setup"
-msgstr ""
-
-#: ipalib/plugins/trust.py:545 ipalib/plugins/trust.py:1350
-msgid ""
-"Cannot perform join operation without Samba 4 support installed. Make sure "
-"you have installed server-trust-ad sub-package of IPA"
-msgstr ""
-
-#: ipalib/plugins/trust.py:553
+#: ipalib/plugins/trust.py:738
 msgid "missing base_id"
 msgstr ""
 
-#: ipalib/plugins/trust.py:555
+#: ipalib/plugins/trust.py:740
 msgid "pysss_murmur is not available on the server and no base-id is given."
 msgstr ""
 
-#: ipalib/plugins/trust.py:561 ipalib/plugins/trust.py:565
+#: ipalib/plugins/trust.py:746 ipalib/plugins/trust.py:750
 msgid "trust type"
 msgstr ""
 
-#: ipalib/plugins/trust.py:566
+#: ipalib/plugins/trust.py:751
 msgid "only \"ad\" is supported"
 msgstr ""
 
-#: ipalib/plugins/trust.py:576
+#: ipalib/plugins/trust.py:757
+msgid "domain"
+msgstr ""
+
+#: ipalib/plugins/trust.py:758
+msgid ""
+"Cannot establish a trust to AD deployed in the same domain as IPA. Such "
+"setup is not supported."
+msgstr ""
+
+#: ipalib/plugins/trust.py:769
 msgid "Realm-domain mismatch"
 msgstr ""
 
-#: ipalib/plugins/trust.py:577
+#: ipalib/plugins/trust.py:770
 msgid ""
 "To establish trust with Active Directory, the domain name and the realm name "
 "of the IPA server must match"
 msgstr ""
 
-#: ipalib/plugins/trust.py:607
+#: ipalib/plugins/trust.py:796
+#, python-format
+msgid ""
+"Trusted domain %(domain)s is included among IPA realm domains. It needs to "
+"be removed prior to establishing the trust. See the \"ipa realmdomains-mod --"
+"del-domain\" command."
+msgstr ""
+
+#: ipalib/plugins/trust.py:817
 msgid "Trusted domain and administrator account use different realms"
 msgstr ""
 
-#: ipalib/plugins/trust.py:616
+#: ipalib/plugins/trust.py:826
 msgid "Realm administrator password should be specified"
 msgstr ""
 
-#: ipalib/plugins/trust.py:637
+#: ipalib/plugins/trust.py:847
 msgid "id range type"
 msgstr ""
 
-#: ipalib/plugins/trust.py:639
+#: ipalib/plugins/trust.py:849
 msgid ""
 "Only the ipa-ad-trust and ipa-ad-trust-posix are allowed values for --range-"
 "type when adding an AD trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:649
+#: ipalib/plugins/trust.py:859
 msgid "id range"
 msgstr ""
 
-#: ipalib/plugins/trust.py:651
+#: ipalib/plugins/trust.py:861
 msgid ""
 "An id range already exists for this trust. You should either delete the old "
 "range, or exclude --base-id/--range-size options from the command."
 msgstr ""
 
-#: ipalib/plugins/trust.py:673
+#: ipalib/plugins/trust.py:883
 msgid "range exists"
 msgstr ""
 
-#: ipalib/plugins/trust.py:675
+#: ipalib/plugins/trust.py:885
 msgid ""
 "ID range with the same name but different domain SID already exists. The ID "
 "range for the new trusted domain must be created manually."
 msgstr ""
 
-#: ipalib/plugins/trust.py:682
+#: ipalib/plugins/trust.py:892
 msgid "range type change"
 msgstr ""
 
-#: ipalib/plugins/trust.py:683
+#: ipalib/plugins/trust.py:893
 msgid ""
 "ID range for the trusted domain already exists, but it has a different type. "
 "Please remove the old range manually, or do not enforce type via --range-"
 "type option."
 msgstr ""
 
-#: ipalib/plugins/trust.py:712
+#: ipalib/plugins/trust.py:926
 #, python-format
 msgid "Unable to resolve domain controller for '%s' domain. "
 msgstr ""
 
-#: ipalib/plugins/trust.py:718
+#: ipalib/plugins/trust.py:932
 msgid ""
 "Forward policy is defined for it in IPA DNS, perhaps forwarder points to "
 "incorrect host?"
 msgstr ""
 
-#: ipalib/plugins/trust.py:721
+#: ipalib/plugins/trust.py:935
 #, python-format
 msgid ""
 "IPA manages DNS, please verify your DNS configuration and make sure that "
@@ -13579,31 +13876,31 @@ msgid ""
 "documentation. "
 msgstr ""
 
-#: ipalib/plugins/trust.py:731
+#: ipalib/plugins/trust.py:945
 #, python-format
 msgid ""
 "Since IPA does not manage DNS records, ensure DNS is configured to resolve "
 "'%(domain)s' domain from IPA hosts and back."
 msgstr ""
 
-#: ipalib/plugins/trust.py:738
+#: ipalib/plugins/trust.py:952
 msgid "Unable to verify write permissions to the AD"
 msgstr ""
 
-#: ipalib/plugins/trust.py:771
+#: ipalib/plugins/trust.py:986
 msgid "Not enough arguments specified to perform trust setup"
 msgstr ""
 
-#: ipalib/plugins/trust.py:776
+#: ipalib/plugins/trust.py:991
 msgid "Delete a trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:778
+#: ipalib/plugins/trust.py:993
 #, python-format
 msgid "Deleted trust \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:782
+#: ipalib/plugins/trust.py:997
 msgid ""
 "\n"
 "    Modify a trust (for future use).\n"
@@ -13613,203 +13910,209 @@ msgid ""
 "    "
 msgstr ""
 
-#: ipalib/plugins/trust.py:789
+#: ipalib/plugins/trust.py:1004
 #, python-format
 msgid "Modified trust \"%(value)s\" (change will be effective in 60 seconds)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:801
+#: ipalib/plugins/trust.py:1016
 msgid "Search for trusts."
 msgstr ""
 
-#: ipalib/plugins/trust.py:806
+#: ipalib/plugins/trust.py:1021
 #, python-format
 msgid "%(count)d trust matched"
 msgid_plural "%(count)d trusts matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/trust.py:832
+#: ipalib/plugins/trust.py:1047
 msgid "Display information about a trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:867
+#: ipalib/plugins/trust.py:1082
 msgid "trust configuration"
 msgstr ""
 
-#: ipalib/plugins/trust.py:873 ipalib/plugins/trust.py:874
+#: ipalib/plugins/trust.py:1088 ipalib/plugins/trust.py:1089
 msgid "Global Trust Configuration"
 msgstr ""
 
-#: ipalib/plugins/trust.py:882
+#: ipalib/plugins/trust.py:1097
 msgid "Security Identifier"
 msgstr ""
 
-#: ipalib/plugins/trust.py:886
+#: ipalib/plugins/trust.py:1101
 msgid "NetBIOS name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:890
+#: ipalib/plugins/trust.py:1105
 msgid "Domain GUID"
 msgstr ""
 
-#: ipalib/plugins/trust.py:895
+#: ipalib/plugins/trust.py:1110
 msgid "Fallback primary group"
 msgstr ""
 
-#: ipalib/plugins/trust.py:907
+#: ipalib/plugins/trust.py:1122
 msgid "unsupported trust type"
 msgstr ""
 
-#: ipalib/plugins/trust.py:970
+#: ipalib/plugins/trust.py:1185
 msgid "Modify global trust configuration."
 msgstr ""
 
-#: ipalib/plugins/trust.py:973
+#: ipalib/plugins/trust.py:1188
 #, python-format
 msgid "Modified \"%(value)s\" trust configuration"
 msgstr ""
 
-#: ipalib/plugins/trust.py:992
+#: ipalib/plugins/trust.py:1207
 msgid "Show global trust configuration."
 msgstr ""
 
-#: ipalib/plugins/trust.py:1019
+#: ipalib/plugins/trust.py:1234
 msgid "Resolve security identifiers of users and groups in trusted domains"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1023
+#: ipalib/plugins/trust.py:1238
 msgid "Security Identifiers (SIDs)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1029
+#: ipalib/plugins/trust.py:1244
 msgid "Name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1030
+#: ipalib/plugins/trust.py:1245
 msgid "SID"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1061
+#: ipalib/plugins/trust.py:1276
 msgid "Determine whether ipa-adtrust-install has been run on this system"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1088
+#: ipalib/plugins/trust.py:1303
 msgid ""
 "Determine whether Schema Compatibility plugin is configured to serve trusted "
 "domain users and groups"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1141
+#: ipalib/plugins/trust.py:1356
 msgid "Determine whether ipa-adtrust-install has been run with sidgen task"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1157
+#: ipalib/plugins/trust.py:1372
 msgid "sidgen_was_run"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1159
+#: ipalib/plugins/trust.py:1374
 msgid ""
 "This command relies on the existence of the \"editors\" group, but this "
 "group was not found."
 msgstr ""
 
-#: ipalib/plugins/trust.py:1178
+#: ipalib/plugins/trust.py:1393
 msgid "trust domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1179
+#: ipalib/plugins/trust.py:1394
 msgid "trust domains"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1184
+#: ipalib/plugins/trust.py:1399
 msgid "Trusted domains"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1185
+#: ipalib/plugins/trust.py:1400
 msgid "Trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1189
+#: ipalib/plugins/trust.py:1404
 msgid "Domain name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1202
+#: ipalib/plugins/trust.py:1417
 msgid "Trusted domain partner"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1222
+#: ipalib/plugins/trust.py:1437
 msgid "Search domains of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1225
+#: ipalib/plugins/trust.py:1440
 msgid "Domain enabled"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1252
+#: ipalib/plugins/trust.py:1467
 msgid "Modify trustdomain of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1259
+#: ipalib/plugins/trust.py:1474
 msgid "Allow access from the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1270
+#: ipalib/plugins/trust.py:1485
 msgid "Remove infromation about the domain associated with the trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:1272
+#: ipalib/plugins/trust.py:1487
 #, python-format
 msgid "Removed information about the trusted domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:1281
+#: ipalib/plugins/trust.py:1502
 msgid ""
 "cannot delete root domain of the trust, use trust-del to delete the trust "
 "itself"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1341
+#: ipalib/plugins/trust.py:1564
 msgid "Refresh list of the domains associated with the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1371
+#: ipalib/plugins/trust.py:1588
+msgid ""
+"List of trust domains successfully refreshed. Use trustdomain-find command "
+"to list them."
+msgstr ""
+
+#: ipalib/plugins/trust.py:1605
 msgid "List of trust domains successfully refreshed"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1373
+#: ipalib/plugins/trust.py:1607
 msgid "No new trust domains were found"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1383
+#: ipalib/plugins/trust.py:1616
 msgid "Allow use of IPA resources by the domain of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1386
+#: ipalib/plugins/trust.py:1619
 #, python-format
 msgid "Enabled trust domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:1393
+#: ipalib/plugins/trust.py:1627
 msgid "Root domain of the trust is always enabled for the existing trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1423
+#: ipalib/plugins/trust.py:1657
 msgid "Disable use of IPA resources by the domain of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1426
+#: ipalib/plugins/trust.py:1660
 #, python-format
 msgid "Disabled trust domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:1433
+#: ipalib/plugins/trust.py:1668
 msgid ""
 "cannot disable root domain of the trust, use trust-del to delete the trust "
 "itself"
 msgstr ""
 
-#: ipalib/plugins/user.py:49
+#: ipalib/plugins/user.py:57
 msgid ""
 "\n"
 "Users\n"
@@ -13855,115 +14158,124 @@ msgid ""
 "   ipa user-del tuser1\n"
 msgstr ""
 
-#: ipalib/plugins/user.py:333
+#: ipalib/plugins/user.py:349
 msgid "Account disabled"
 msgstr ""
 
-#: ipalib/plugins/user.py:337
+#: ipalib/plugins/user.py:353
 msgid "Preserved user"
 msgstr ""
 
-#: ipalib/plugins/user.py:389
+#: ipalib/plugins/user.py:405
 msgid "Add a new user."
 msgstr ""
 
-#: ipalib/plugins/user.py:391
+#: ipalib/plugins/user.py:407
 #, python-format
 msgid "Added user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:398
+#: ipalib/plugins/user.py:414
 msgid "Don't create user private group"
 msgstr ""
 
-#: ipalib/plugins/user.py:474
+#: ipalib/plugins/user.py:490
 msgid "Default group for new users is not POSIX"
 msgstr ""
 
-#: ipalib/plugins/user.py:563
+#: ipalib/plugins/user.py:580
 msgid "Delete a user."
 msgstr ""
 
-#: ipalib/plugins/user.py:565
+#: ipalib/plugins/user.py:582
 #, python-format
 msgid "Deleted user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:573
+#: ipalib/plugins/user.py:590
 msgid "Delete a user, keeping the entry available for future use"
 msgstr ""
 
-#: ipalib/plugins/user.py:577
+#: ipalib/plugins/user.py:594
 msgid "Delete a user"
 msgstr ""
 
-#: ipalib/plugins/user.py:585
+#: ipalib/plugins/user.py:608
+#, python-format
+msgid "%s: user is already preserved"
+msgstr ""
+
+#: ipalib/plugins/user.py:660
 msgid "preserve and no-preserve cannot be both set"
 msgstr ""
 
-#: ipalib/plugins/user.py:686
+#: ipalib/plugins/user.py:729
 msgid "Modify a user."
 msgstr ""
 
-#: ipalib/plugins/user.py:688
+#: ipalib/plugins/user.py:731
 #, python-format
 msgid "Modified user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:705
+#: ipalib/plugins/user.py:749
 msgid "Search for users."
 msgstr ""
 
-#: ipalib/plugins/user.py:716
+#: ipalib/plugins/user.py:760
 msgid "Self"
 msgstr ""
 
-#: ipalib/plugins/user.py:717
+#: ipalib/plugins/user.py:761
 msgid "Display user record for current Kerberos principal"
 msgstr ""
 
-#: ipalib/plugins/user.py:764
+#: ipalib/plugins/user.py:804
 msgid "Display information about a user."
 msgstr ""
 
-#: ipalib/plugins/user.py:776
+#: ipalib/plugins/user.py:844
 msgid "Undelete a delete user account."
 msgstr ""
 
-#: ipalib/plugins/user.py:779
+#: ipalib/plugins/user.py:847
 #, python-format
 msgid "Undeleted user account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:789
+#: ipalib/plugins/user.py:861
 #, python-format
-msgid "User %r is already active"
+msgid "user \"%s\" is already active"
+msgstr ""
+
+#: ipalib/plugins/user.py:889
+msgid "Move deleted user into staged area"
 msgstr ""
 
-#: ipalib/plugins/user.py:795
+#: ipalib/plugins/user.py:892
 #, python-format
-msgid "User %r not found"
+msgid "Staged user account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:822
+#: ipalib/plugins/user.py:939
 msgid "Disable a user account."
 msgstr ""
 
-#: ipalib/plugins/user.py:825
+#: ipalib/plugins/user.py:942
 #, python-format
 msgid "Disabled user account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:843
+#: ipalib/plugins/user.py:960
 msgid "Enable a user account."
 msgstr ""
 
-#: ipalib/plugins/user.py:847
+#: ipalib/plugins/user.py:964
 #, python-format
 msgid "Enabled user account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:864
+#: ipalib/plugins/user.py:981
 msgid ""
 "\n"
 "    Unlock a user account\n"
@@ -13975,12 +14287,12 @@ msgid ""
 "    an administrator."
 msgstr ""
 
-#: ipalib/plugins/user.py:873
+#: ipalib/plugins/user.py:990
 #, python-format
 msgid "Unlocked account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:893
+#: ipalib/plugins/user.py:1010
 msgid ""
 "\n"
 "    Lockout status of a user account\n"
@@ -14009,539 +14321,896 @@ msgid ""
 "    means that the user may attempt a login again. "
 msgstr ""
 
-#: ipalib/plugins/user.py:951
+#: ipalib/plugins/user.py:1066
 #, python-format
 msgid "%(host)s failed: %(error)s"
 msgstr ""
 
-#: ipalib/plugins/user.py:988
+#: ipalib/plugins/user.py:1103
 #, python-format
 msgid "%(host)s failed"
 msgstr ""
 
-#: ipalib/plugins/user.py:998
+#: ipalib/plugins/user.py:1113
 #, python-format
 msgid "Account disabled: %(disabled)s"
 msgstr ""
 
-#: ipalib/plugins/vault.py:48
+#: ipalib/plugins/user.py:1120
+msgid "Add one or more certificates to the user entry"
+msgstr ""
+
+#: ipalib/plugins/user.py:1121
+#, python-format
+msgid "Added certificates to user \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/user.py:1142
+msgid "Remove one or more certificates to the user entry"
+msgstr ""
+
+#: ipalib/plugins/user.py:1143
+#, python-format
+msgid "Removed certificates from user \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/user.py:1164
+msgid "Add a manager to the user entry"
+msgstr ""
+
+#: ipalib/plugins/user.py:1169
+msgid "Remove a manager to the user entry"
+msgstr ""
+
+#: ipalib/plugins/vault.py:61
 msgid ""
 "\n"
 "Vaults\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:50
+#: ipalib/plugins/vault.py:63
 msgid ""
 "\n"
 "Manage vaults.\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:54
+#: ipalib/plugins/vault.py:65
 msgid ""
 "\n"
-" List private vaults:\n"
-"   ipa vault-find\n"
+"Vault is a secure place to store a secret.\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:57
+#: ipalib/plugins/vault.py:67
 msgid ""
 "\n"
-" List service vaults:\n"
-"   ipa vault-find --service <service name>\n"
+"Based on the ownership there are three vault categories:\n"
+"* user/private vault\n"
+"* service vault\n"
+"* shared vault\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:60
+#: ipalib/plugins/vault.py:72
 msgid ""
 "\n"
-" List shared vaults:\n"
-"   ipa vault-find --shared\n"
+"User vaults are vaults owned used by a particular user. Private\n"
+"vaults are vaults owned the current user. Service vaults are\n"
+"vaults owned by a service. Shared vaults are owned by the admin\n"
+"but they can be used by other users or services.\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:63
+#: ipalib/plugins/vault.py:77
 msgid ""
 "\n"
-" List user vaults:\n"
-"   ipa vault-find --user <username>\n"
+"Based on the security mechanism there are three types of\n"
+"vaults:\n"
+"* standard vault\n"
+"* symmetric vault\n"
+"* asymmetric vault\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:66
+#: ipalib/plugins/vault.py:83
 msgid ""
 "\n"
-" Add a private vault:\n"
-"   ipa vault-add <name>\n"
+"Standard vault uses a secure mechanism to transport and\n"
+"store the secret. The secret can only be retrieved by users\n"
+"that have access to the vault.\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:69
+#: ipalib/plugins/vault.py:87
 msgid ""
 "\n"
-" Add a service vault:\n"
-"   ipa vault-add <name> --service <service name>\n"
+"Symmetric vault is similar to the standard vault, but it\n"
+"pre-encrypts the secret using a password before transport.\n"
+"The secret can only be retrieved using the same password.\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:72
+#: ipalib/plugins/vault.py:91
 msgid ""
 "\n"
-" Add a shared vault:\n"
-"   ipa vault-add <ame> --shared\n"
+"Asymmetric vault is similar to the standard vault, but it\n"
+"pre-encrypts the secret using a public key before transport.\n"
+"The secret can only be retrieved using the private key.\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:75
+#: ipalib/plugins/vault.py:97
 msgid ""
 "\n"
-" Add a user vault:\n"
-"   ipa vault-add <name> --user <username>\n"
+" List vaults:\n"
+"   ipa vault-find\n"
+"       [--user <user>|--service <service>|--shared]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:78
+#: ipalib/plugins/vault.py:101
 msgid ""
 "\n"
-" Show a private vault:\n"
-"   ipa vault-show <name>\n"
+" Add a standard vault:\n"
+"   ipa vault-add <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --type standard\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:81
+#: ipalib/plugins/vault.py:106
 msgid ""
 "\n"
-" Show a service vault:\n"
-"   ipa vault-show <name> --service <service name>\n"
+" Add a symmetric vault:\n"
+"   ipa vault-add <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --type symmetric --password-file password.txt\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:84
+#: ipalib/plugins/vault.py:111
 msgid ""
 "\n"
-" Show a shared vault:\n"
-"   ipa vault-show <name> --shared\n"
+" Add an asymmetric vault:\n"
+"   ipa vault-add <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --type asymmetric --public-key-file public.pem\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:87
+#: ipalib/plugins/vault.py:116
 msgid ""
 "\n"
-" Show a user vault:\n"
-"   ipa vault-show <name> --user <username>\n"
+" Show a vault:\n"
+"   ipa vault-show <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:90
+#: ipalib/plugins/vault.py:120
 msgid ""
 "\n"
-" Modify a private vault:\n"
-"   ipa vault-mod <name> --desc <description>\n"
+" Modify vault description:\n"
+"   ipa vault-mod <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --desc <description>\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:93
+#: ipalib/plugins/vault.py:125
 msgid ""
 "\n"
-" Modify a service vault:\n"
-"   ipa vault-mod <name> --service <service name> --desc <description>\n"
+" Modify vault type:\n"
+"   ipa vault-mod <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --type <type>\n"
+"       [old password/private key]\n"
+"       [new password/public key]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:96
+#: ipalib/plugins/vault.py:132
 msgid ""
 "\n"
-" Modify a shared vault:\n"
-"   ipa vault-mod <name> --shared --desc <description>\n"
+" Modify symmetric vault password:\n"
+"   ipa vault-mod <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --change-password\n"
+"   ipa vault-mod <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --old-password <old password>\n"
+"       --new-password <new password>\n"
+"   ipa vault-mod <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --old-password-file <old password file>\n"
+"       --new-password-file <new password file>\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:99
+#: ipalib/plugins/vault.py:145
 msgid ""
 "\n"
-" Modify a user vault:\n"
-"   ipa vault-mod <name> --user <username> --desc <description>\n"
+" Modify asymmetric vault keys:\n"
+"   ipa vault-mod <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --private-key-file <old private key file>\n"
+"       --public-key-file <new public key file>\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:102
+#: ipalib/plugins/vault.py:151
 msgid ""
 "\n"
-" Delete a private vault:\n"
+" Delete a vault:\n"
 "   ipa vault-del <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:105
+#: ipalib/plugins/vault.py:155
 msgid ""
 "\n"
-" Delete a service vault:\n"
-"   ipa vault-del <name> --service <service name>\n"
+" Display vault configuration:\n"
+"   ipa vaultconfig-show\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:108
+#: ipalib/plugins/vault.py:158
 msgid ""
 "\n"
-" Delete a shared vault:\n"
-"   ipa vault-del <name> --shared\n"
+" Archive data into standard vault:\n"
+"   ipa vault-archive <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --in <input file>\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:111
+#: ipalib/plugins/vault.py:163
 msgid ""
 "\n"
-" Delete a user vault:\n"
-"   ipa vault-del <name> --user <username>\n"
+" Archive data into symmetric vault:\n"
+"   ipa vault-archive <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --in <input file>\n"
+"       --password-file password.txt\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:114
+#: ipalib/plugins/vault.py:169
 msgid ""
 "\n"
-" Display vault configuration:\n"
-"   ipa vault-config\n"
+" Archive data into asymmetric vault:\n"
+"   ipa vault-archive <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --in <input file>\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:117
+#: ipalib/plugins/vault.py:174
 msgid ""
 "\n"
-" Archive data into private vault:\n"
-"   ipa vault-archive <name> --in <input file>\n"
+" Retrieve data from standard vault:\n"
+"   ipa vault-retrieve <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --out <output file>\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:120
+#: ipalib/plugins/vault.py:179
 msgid ""
 "\n"
-" Archive data into service vault:\n"
-"   ipa vault-archive <name> --service <service name> --in <input file>\n"
+" Retrieve data from symmetric vault:\n"
+"   ipa vault-retrieve <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --out <output file>\n"
+"       --password-file password.txt\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:123
+#: ipalib/plugins/vault.py:185
 msgid ""
 "\n"
-" Archive data into shared vault:\n"
-"   ipa vault-archive <name> --shared --in <input file>\n"
+" Retrieve data from asymmetric vault:\n"
+"   ipa vault-retrieve <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       --out <output file> --private-key-file private.pem\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:126
+#: ipalib/plugins/vault.py:190
 msgid ""
 "\n"
-" Archive data into user vault:\n"
-"   ipa vault-archive <name> --user <username> --in <input file>\n"
+" Add vault owners:\n"
+"   ipa vault-add-owner <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       [--users <users>]  [--groups <groups>] [--services <services>]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:129
+#: ipalib/plugins/vault.py:195
 msgid ""
 "\n"
-" Retrieve data from private vault:\n"
-"   ipa vault-retrieve <name> --out <output file>\n"
+" Delete vault owners:\n"
+"   ipa vault-remove-owner <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       [--users <users>] [--groups <groups>] [--services <services>]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:132
+#: ipalib/plugins/vault.py:200
 msgid ""
 "\n"
-" Retrieve data from service vault:\n"
-"   ipa vault-retrieve <name> --service <service name> --out <output file>\n"
+" Add vault members:\n"
+"   ipa vault-add-member <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       [--users <users>] [--groups <groups>] [--services <services>]\n"
 msgstr ""
 
-#: ipalib/plugins/vault.py:135
+#: ipalib/plugins/vault.py:205
 msgid ""
 "\n"
-" Retrieve data from shared vault:\n"
-"   ipa vault-retrieve <name> --shared --out <output file>\n"
+" Delete vault members:\n"
+"   ipa vault-remove-member <name>\n"
+"       [--user <user>|--service <service>|--shared]\n"
+"       [--users <users>] [--groups <groups>] [--services <services>]\n"
+msgstr ""
+
+#: ipalib/plugins/vault.py:225 ipalib/plugins/vault.py:1551
+#, python-format
+msgid "Cannot read file '%(filename)s': %(exc)s"
+msgstr ""
+
+#: ipalib/plugins/vault.py:232
+#, python-format
+msgid "Cannot decode file '%(filename)s': %(exc)s"
 msgstr ""
 
-#: ipalib/plugins/vault.py:138
+#: ipalib/plugins/vault.py:246
+msgid "Service name of the service vault"
+msgstr ""
+
+#: ipalib/plugins/vault.py:251 ipalib/plugins/vault.py:368
+#: ipalib/plugins/vault.py:681
+msgid "Shared vault"
+msgstr ""
+
+#: ipalib/plugins/vault.py:256
+msgid "Username of the user vault"
+msgstr ""
+
+#: ipalib/plugins/vault.py:284
 msgid ""
 "\n"
-" Retrieve data from user vault:\n"
-"   ipa vault-retrieve <name> --user <user name> --out <output file>\n"
+"    Vault Container object.\n"
+"    "
 msgstr ""
 
-#: ipalib/plugins/vault.py:153
-msgid "Shared vault"
+#: ipalib/plugins/vault.py:290
+msgid "vaultcontainer"
+msgstr ""
+
+#: ipalib/plugins/vault.py:291
+msgid "vaultcontainers"
+msgstr ""
+
+#: ipalib/plugins/vault.py:299
+msgid "Vault Containers"
+msgstr ""
+
+#: ipalib/plugins/vault.py:300
+msgid "Vault Container"
+msgstr ""
+
+#: ipalib/plugins/vault.py:347 ipalib/plugins/vault.py:656
+msgid "Owner users"
+msgstr ""
+
+#: ipalib/plugins/vault.py:351 ipalib/plugins/vault.py:661
+msgid "Owner groups"
+msgstr ""
+
+#: ipalib/plugins/vault.py:355 ipalib/plugins/vault.py:666
+msgid "Owner services"
+msgstr ""
+
+#: ipalib/plugins/vault.py:359 ipalib/plugins/vault.py:671
+msgid "Failed owners"
+msgstr ""
+
+#: ipalib/plugins/vault.py:363 ipalib/plugins/vault.py:676
+msgid "Vault service"
+msgstr ""
+
+#: ipalib/plugins/vault.py:373 ipalib/plugins/vault.py:686
+msgid "Vault user"
+msgstr ""
+
+#: ipalib/plugins/vault.py:389
+msgid "Service, shared and user options cannot be specified simultaneously"
+msgstr ""
+
+#: ipalib/plugins/vault.py:399 ipalib/plugins/vault.py:717
+msgid "Host is not supported"
+msgstr ""
+
+#: ipalib/plugins/vault.py:432
+msgid "Display information about a vault container."
+msgstr ""
+
+#: ipalib/plugins/vault.py:443 ipalib/plugins/vault.py:467
+#: ipalib/plugins/vault.py:1072 ipalib/plugins/vault.py:1111
+#: ipalib/plugins/vault.py:1168 ipalib/plugins/vault.py:1395
+#: ipalib/plugins/vault.py:1417 ipalib/plugins/vault.py:1469
+#: ipalib/plugins/vault.py:1721 ipalib/plugins/vault.py:1989
+msgid "KRA service is not enabled"
+msgstr ""
+
+#: ipalib/plugins/vault.py:454
+msgid "Delete a vault container."
+msgstr ""
+
+#: ipalib/plugins/vault.py:458
+msgid "Deleted vault container"
+msgstr ""
+
+#: ipalib/plugins/vault.py:478
+msgid "Add owners to a vault container."
+msgstr ""
+
+#: ipalib/plugins/vault.py:483 ipalib/plugins/vault.py:508
+#: ipalib/plugins/vault.py:2041 ipalib/plugins/vault.py:2066
+#, python-format
+msgid "owner %s"
+msgstr ""
+
+#: ipalib/plugins/vault.py:491 ipalib/plugins/vault.py:2049
+msgid "Owners that could not be added"
+msgstr ""
+
+#: ipalib/plugins/vault.py:496 ipalib/plugins/vault.py:2054
+msgid "Number of owners added"
+msgstr ""
+
+#: ipalib/plugins/vault.py:503
+msgid "Remove owners from a vault container."
+msgstr ""
+
+#: ipalib/plugins/vault.py:516 ipalib/plugins/vault.py:2074
+msgid "Owners that could not be removed"
+msgstr ""
+
+#: ipalib/plugins/vault.py:521 ipalib/plugins/vault.py:2079
+msgid "Number of owners removed"
 msgstr ""
 
-#: ipalib/plugins/vault.py:164
+#: ipalib/plugins/vault.py:528
 msgid ""
 "\n"
 "    Vault object.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/vault.py:170
+#: ipalib/plugins/vault.py:534
 msgid "vault"
 msgstr ""
 
-#: ipalib/plugins/vault.py:171
+#: ipalib/plugins/vault.py:535
 msgid "vaults"
 msgstr ""
 
-#: ipalib/plugins/vault.py:179
+#: ipalib/plugins/vault.py:558
 msgid "Vaults"
 msgstr ""
 
-#: ipalib/plugins/vault.py:180
+#: ipalib/plugins/vault.py:559
 msgid "Vault"
 msgstr ""
 
-#: ipalib/plugins/vault.py:186
+#: ipalib/plugins/vault.py:619
 msgid "Vault name"
 msgstr ""
 
-#: ipalib/plugins/vault.py:196
+#: ipalib/plugins/vault.py:629 ipalib/plugins/vault.py:902
+#: ipalib/plugins/vault.py:1215
 msgid "Vault description"
 msgstr ""
 
-#: ipalib/plugins/vault.py:221
-msgid "Service, shared, and user options cannot be specified simultaneously"
+#: ipalib/plugins/vault.py:635 ipalib/plugins/vault.py:908
+#: ipalib/plugins/vault.py:1220
+msgid "Vault type"
 msgstr ""
 
-#: ipalib/plugins/vault.py:236
-msgid "Host is not supported"
+#: ipalib/plugins/vault.py:643
+msgid "Salt"
+msgstr ""
+
+#: ipalib/plugins/vault.py:644 ipalib/plugins/vault.py:1225
+msgid "Vault salt"
+msgstr ""
+
+#: ipalib/plugins/vault.py:650
+msgid "Public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:651 ipalib/plugins/vault.py:926
+msgid "Vault public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:702
+msgid "Service, shared, and user options cannot be specified simultaneously"
 msgstr ""
 
-#: ipalib/plugins/vault.py:313
+#: ipalib/plugins/vault.py:896
 msgid "Create a new vault."
 msgstr ""
 
-#: ipalib/plugins/vault.py:317
+#: ipalib/plugins/vault.py:916 ipalib/plugins/vault.py:1497
+#: ipalib/plugins/vault.py:1782
+msgid "Vault password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:921 ipalib/plugins/vault.py:1502
+#: ipalib/plugins/vault.py:1787
+msgid "File containing the vault password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:931
+msgid "File containing the vault public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:955
+msgid "Password can be specified only for symmetric vault"
+msgstr ""
+
+#: ipalib/plugins/vault.py:961
+msgid "Public key can be specified only for asymmetric vault"
+msgstr ""
+
+#: ipalib/plugins/vault.py:981 ipalib/plugins/vault.py:1584
+#: ipalib/plugins/vault.py:1907
+msgid "Password specified multiple times"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1003
+msgid "Public key specified multiple times"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1019
+msgid "Missing vault public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1031
 #, python-format
-msgid "Added vault \"%(value)s\""
+msgid "Invalid or unsupported vault public key: %s"
 msgstr ""
 
-#: ipalib/plugins/vault.py:325 ipalib/plugins/vault.py:349
-#: ipalib/plugins/vault.py:395 ipalib/plugins/vault.py:427
-#: ipalib/plugins/vault.py:443 ipalib/plugins/vault.py:491
-#: ipalib/plugins/vault.py:629 ipalib/plugins/vault.py:779
-msgid "KRA service is not enabled"
+#: ipalib/plugins/vault.py:1064
+#, python-format
+msgid "Added vault \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/vault.py:338
+#: ipalib/plugins/vault.py:1100
 msgid "Delete a vault."
 msgstr ""
 
-#: ipalib/plugins/vault.py:342
+#: ipalib/plugins/vault.py:1104
 #, python-format
 msgid "Deleted vault \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/vault.py:379
+#: ipalib/plugins/vault.py:1141
 msgid "Search for vaults."
 msgstr ""
 
-#: ipalib/plugins/vault.py:384
+#: ipalib/plugins/vault.py:1146
+msgid "List all service vaults"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1150
+msgid "List all user vaults"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1157
 #, python-format
 msgid "%(count)d vault matched"
 msgid_plural "%(count)d vaults matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/vault.py:414
+#: ipalib/plugins/vault.py:1175
+msgid ""
+"Service(s), shared, and user(s) options cannot be specified simultaneously"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1209
 msgid "Modify a vault."
 msgstr ""
 
-#: ipalib/plugins/vault.py:418
+#: ipalib/plugins/vault.py:1229
+msgid "Change password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1234
+msgid "Old vault password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1239
+msgid "File containing the old vault password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1244
+msgid "New vault password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1249
+msgid "File containing the new vault password"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1254
+msgid "Old vault private key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1259
+msgid "File containing the old vault private key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1264
+msgid "New vault public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1269
+msgid "File containing the new vault public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1344
+msgid "New public key specified multiple times"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1357
+msgid "Missing new vault public key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1386
 #, python-format
 msgid "Modified vault \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/vault.py:434
+#: ipalib/plugins/vault.py:1406
 msgid "Display information about a vault."
 msgstr ""
 
-#: ipalib/plugins/vault.py:450
+#: ipalib/plugins/vault.py:1428
 msgid "Vault configuration"
 msgstr ""
 
-#: ipalib/plugins/vault.py:455
+#: ipalib/plugins/vault.py:1433
 msgid "Transport Certificate"
 msgstr ""
 
-#: ipalib/plugins/vault.py:462
+#: ipalib/plugins/vault.py:1440
 msgid "Show vault configuration."
 msgstr ""
 
-#: ipalib/plugins/vault.py:467
+#: ipalib/plugins/vault.py:1445
 msgid "Output file to store the transport certificate"
 msgstr ""
 
-#: ipalib/plugins/vault.py:505
+#: ipalib/plugins/vault.py:1483
 msgid "Archive data into a vault."
 msgstr ""
 
-#: ipalib/plugins/vault.py:510
+#: ipalib/plugins/vault.py:1488
 msgid "Binary data to archive"
 msgstr ""
 
-#: ipalib/plugins/vault.py:514
+#: ipalib/plugins/vault.py:1492
 msgid "File containing data to archive"
 msgstr ""
 
-#: ipalib/plugins/vault.py:520
-#, python-format
-msgid "Archived data into vault \"%(value)s\""
+#: ipalib/plugins/vault.py:1506
+msgid "Override existing password"
 msgstr ""
 
-#: ipalib/plugins/vault.py:536
+#: ipalib/plugins/vault.py:1537
 msgid "Input data specified multiple times"
 msgstr ""
 
-#: ipalib/plugins/vault.py:613 ipalib/plugins/vault.py:771
+#: ipalib/plugins/vault.py:1542 ipalib/plugins/vault.py:1555
+#, python-format
+msgid ""
+"Size of data exceeds the limit. Current vault data size limit is %(limit)d B"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1638 ipalib/plugins/vault.py:1957
+msgid "Invalid vault type"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1701 ipalib/plugins/vault.py:1977
 msgid "Session key wrapped with transport certificate"
 msgstr ""
 
-#: ipalib/plugins/vault.py:617
+#: ipalib/plugins/vault.py:1705
 msgid "Vault data encrypted with session key"
 msgstr ""
 
-#: ipalib/plugins/vault.py:621
+#: ipalib/plugins/vault.py:1709
 msgid "Nonce"
 msgstr ""
 
-#: ipalib/plugins/vault.py:674
+#: ipalib/plugins/vault.py:1715
+#, python-format
+msgid "Archived data into vault \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/vault.py:1772
 msgid "Retrieve a data from a vault."
 msgstr ""
 
-#: ipalib/plugins/vault.py:679
+#: ipalib/plugins/vault.py:1777
 msgid "File to store retrieved data"
 msgstr ""
 
-#: ipalib/plugins/vault.py:691
+#: ipalib/plugins/vault.py:1792
+msgid "Vault private key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1797
+msgid "File containing the vault private key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1932
+msgid "Private key specified multiple times"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1945
+msgid "Missing vault private key"
+msgstr ""
+
+#: ipalib/plugins/vault.py:1983
 #, python-format
 msgid "Retrieved data from vault \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/vault.py:801
+#: ipalib/plugins/vault.py:2010
 msgid "No archived data."
 msgstr ""
 
+#: ipalib/plugins/vault.py:2036
+msgid "Add owners to a vault."
+msgstr ""
+
+#: ipalib/plugins/vault.py:2061
+msgid "Remove owners from a vault."
+msgstr ""
+
+#: ipalib/plugins/vault.py:2086
+msgid "Add members to a vault."
+msgstr ""
+
+#: ipalib/plugins/vault.py:2093
+msgid "Remove members from a vault."
+msgstr ""
+
 #: ipalib/plugins/virtual.py:52
 msgid "operation not defined"
 msgstr ""
 
 #: ipalib/plugins/virtual.py:65
-msgid "not allowed to perform this command"
+#, python-format
+msgid "not allowed to perform operation: %s"
 msgstr ""
 
 #: ipalib/plugins/virtual.py:67
 msgid "No such virtual command"
 msgstr ""
 
-#: ipalib/rpc.py:849
+#: ipalib/rpc.py:938
 msgid "any of the configured servers"
 msgstr ""
 
-#: ipalib/session.py:777 ipalib/session.py:880
+#: ipalib/session.py:778 ipalib/session.py:881
 msgid "could not allocate unique new session_id"
 msgstr ""
 
-#: ipalib/util.py:205
+#: ipalib/util.py:174
 msgid "Filename is empty"
 msgstr ""
 
-#: ipalib/util.py:209
+#: ipalib/util.py:178
 #, python-format
 msgid "Permission denied: %(file)s"
 msgstr ""
 
-#: ipalib/util.py:251 ipalib/util.py:757
+#: ipalib/util.py:220 ipalib/util.py:728
 msgid "empty DNS label"
 msgstr ""
 
-#: ipalib/util.py:254
+#: ipalib/util.py:223
 msgid "DNS label cannot be longer that 63 characters"
 msgstr ""
 
-#: ipalib/util.py:259
+#: ipalib/util.py:228
 #, python-format
 msgid ""
 "only letters, numbers, %(chars)s are allowed. DNS label may not start or end "
 "with %(chars2)s"
 msgstr ""
 
-#: ipalib/util.py:277
+#: ipalib/util.py:247
 msgid "too many '@' characters"
 msgstr ""
 
-#: ipalib/util.py:293
+#: ipalib/util.py:263
 msgid "cannot be longer that 255 characters"
 msgstr ""
 
-#: ipalib/util.py:299
+#: ipalib/util.py:269
 msgid "hostname contains empty label (consecutive dots)"
 msgstr ""
 
-#: ipalib/util.py:303
+#: ipalib/util.py:273
 msgid "not fully qualified"
 msgstr ""
 
-#: ipalib/util.py:315 ipalib/util.py:321
+#: ipalib/util.py:285 ipalib/util.py:291
 msgid "invalid SSH public key"
 msgstr ""
 
-#: ipalib/util.py:324
+#: ipalib/util.py:294
 msgid "options are not allowed"
 msgstr ""
 
-#: ipalib/util.py:560
+#: ipalib/util.py:530
 msgid "invalid hostmask"
 msgstr ""
 
-#: ipalib/util.py:572
+#: ipalib/util.py:542
 #, python-format
 msgid "query '%(owner)s %(rtype)s': %(error)s"
 msgstr ""
 
-#: ipalib/util.py:576
+#: ipalib/util.py:546
 #, python-format
 msgid "query '%(owner)s %(rtype)s' with EDNS0: %(error)s"
 msgstr ""
 
-#: ipalib/util.py:580
+#: ipalib/util.py:550
 #, python-format
 msgid ""
 "answer to query '%(owner)s %(rtype)s' is missing DNSSEC signatures (no RRSIG "
 "data)"
 msgstr ""
 
-#: ipalib/util.py:585
+#: ipalib/util.py:555
 #, python-format
 msgid "record '%(owner)s %(rtype)s' failed DNSSEC validation on server %(ip)s"
 msgstr ""
 
-#: ipalib/util.py:755
+#: ipalib/util.py:726
 msgid "invalid escape code in domain name"
 msgstr ""
 
-#: ipalib/util.py:759
+#: ipalib/util.py:730
 msgid "domain name cannot be longer than 255 characters"
 msgstr ""
 
-#: ipalib/util.py:761
+#: ipalib/util.py:732
 msgid "DNS label cannot be longer than 63 characters"
 msgstr ""
 
-#: ipalib/util.py:763
+#: ipalib/util.py:734
 msgid "invalid domain name"
 msgstr ""
 
-#: ipalib/util.py:775
+#: ipalib/util.py:747
 #, python-format
 msgid "domain name '%(domain)s' should be normalized to: %(normalized)s"
 msgstr ""
 
-#: ipalib/x509.py:302
+#: ipalib/x509.py:320
 msgid "improperly formatted DER-encoded certificate"
 msgstr ""
 
-#: ipalib/x509.py:357
+#: ipalib/x509.py:374
 #, python-format
 msgid "Issuer \"%(issuer)s\" does not match the expected issuer"
 msgstr ""
 
-#: ipapython/dogtag.py:194
+#: ipapython/dogtag.py:85
 #, python-format
 msgid "Retrieving CA cert chain failed: %s"
 msgstr ""
 
-#: ipapython/dogtag.py:200
+#: ipapython/dogtag.py:91
 #, python-format
 msgid "request failed with HTTP status %d"
 msgstr ""
 
-#: ipapython/dogtag.py:212 ipapython/dogtag.py:237
+#: ipapython/dogtag.py:103 ipapython/dogtag.py:128
 #, python-format
 msgid "Retrieving CA status failed: %s"
 msgstr ""
 
-#: ipapython/ipaldap.py:1010
+#: ipapython/ipaldap.py:1018
 #, python-format
 msgid "objectclass %s not found"
 msgstr ""
 
-#: ipaserver/dcerpc.py:63
+#: ipaserver/dcerpc.py:68
 msgid ""
 "\n"
 "Classes to manage trust joins using DCE-RPC calls\n"
@@ -14550,203 +15219,208 @@ msgid ""
 "and Samba4 python bindings.\n"
 msgstr ""
 
-#: ipaserver/dcerpc.py:80
+#: ipaserver/dcerpc.py:89
 msgid "CIFS server denied your credentials"
 msgstr ""
 
-#: ipaserver/dcerpc.py:83
+#: ipaserver/dcerpc.py:92
 msgid "communication with CIFS server was unsuccessful"
 msgstr ""
 
-#: ipaserver/dcerpc.py:88
+#: ipaserver/dcerpc.py:97
 msgid "AD domain controller"
 msgstr ""
 
-#: ipaserver/dcerpc.py:88
+#: ipaserver/dcerpc.py:97
 msgid "unsupported functional level"
 msgstr ""
 
-#: ipaserver/dcerpc.py:91
+#: ipaserver/dcerpc.py:100
 msgid ""
 "AD domain controller complains about communication sequence. It may mean "
 "unsynchronized time on both sides, for example"
 msgstr ""
 
-#: ipaserver/dcerpc.py:95
+#: ipaserver/dcerpc.py:104
 msgid "CIFS server configuration does not allow access to \\\\pipe\\lsarpc"
 msgstr ""
 
-#: ipaserver/dcerpc.py:100
+#: ipaserver/dcerpc.py:109
 msgid "Cannot find specified domain or server name"
 msgstr ""
 
-#: ipaserver/dcerpc.py:102
+#: ipaserver/dcerpc.py:111
 msgid ""
 "AD DC was unable to reach any IPA domain controller. Most likely it is a DNS "
 "or firewall issue"
 msgstr ""
 
-#: ipaserver/dcerpc.py:104
+#: ipaserver/dcerpc.py:113
 msgid "At least the domain or IP address should be specified"
 msgstr ""
 
-#: ipaserver/dcerpc.py:116
+#: ipaserver/dcerpc.py:133
 #, python-format
 msgid ""
 "CIFS server communication error: code \"%(num)s\",\n"
 "                  message \"%(message)s\" (both may be \"None\")"
 msgstr ""
 
-#: ipaserver/dcerpc.py:216
+#: ipaserver/dcerpc.py:242
 msgid "no trusted domain is configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:223
+#: ipaserver/dcerpc.py:249
 msgid "domain is not configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:230
+#: ipaserver/dcerpc.py:256
 msgid "SID is not valid"
 msgstr ""
 
-#: ipaserver/dcerpc.py:245
+#: ipaserver/dcerpc.py:271
 msgid "SID does not match exactlywith any trusted domain's SID"
 msgstr ""
 
-#: ipaserver/dcerpc.py:256
+#: ipaserver/dcerpc.py:282
 msgid "SID does not match any trusted domain"
 msgstr ""
 
-#: ipaserver/dcerpc.py:296 ipaserver/dcerpc.py:302 ipaserver/dcerpc.py:571
+#: ipaserver/dcerpc.py:322 ipaserver/dcerpc.py:328 ipaserver/dcerpc.py:671
 msgid "Trust setup"
 msgstr ""
 
-#: ipaserver/dcerpc.py:297
+#: ipaserver/dcerpc.py:323
 msgid "Our domain is not configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:303
+#: ipaserver/dcerpc.py:329
 msgid "No trusted domain is not configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:308 ipaserver/dcerpc.py:323 ipaserver/dcerpc.py:340
-#: ipaserver/dcerpc.py:352 ipaserver/dcerpc.py:359 ipaserver/dcerpc.py:399
-#: ipaserver/dcerpc.py:451
+#: ipaserver/dcerpc.py:334 ipaserver/dcerpc.py:349 ipaserver/dcerpc.py:364
+#: ipaserver/dcerpc.py:371 ipaserver/dcerpc.py:383 ipaserver/dcerpc.py:390
+#: ipaserver/dcerpc.py:451 ipaserver/dcerpc.py:503
 msgid "trusted domain object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:309
+#: ipaserver/dcerpc.py:335
 msgid "domain is not trusted"
 msgstr ""
 
-#: ipaserver/dcerpc.py:324
+#: ipaserver/dcerpc.py:350
 msgid "no trusted domain matched the specified flat name"
 msgstr ""
 
-#: ipaserver/dcerpc.py:326
+#: ipaserver/dcerpc.py:352
 msgid "trusted domain object not found"
 msgstr ""
 
-#: ipaserver/dcerpc.py:341 ipaserver/dcerpc.py:452
+#: ipaserver/dcerpc.py:365
+msgid "SSSD was unable to resolve the object to a valid SID"
+msgstr ""
+
+#: ipaserver/dcerpc.py:372 ipaserver/dcerpc.py:504
 msgid "Ambiguous search, user domain was not specified"
 msgstr ""
 
-#: ipaserver/dcerpc.py:353 ipaserver/dcerpc.py:400
+#: ipaserver/dcerpc.py:384 ipaserver/dcerpc.py:452
 msgid "Trusted domain did not return a unique object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:360
+#: ipaserver/dcerpc.py:391
 msgid "Trusted domain did not return a valid SID for the object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:437 ipaserver/dcerpc.py:447
+#: ipaserver/dcerpc.py:489 ipaserver/dcerpc.py:499
 msgid "trusted domain user not found"
 msgstr ""
 
-#: ipaserver/dcerpc.py:572
+#: ipaserver/dcerpc.py:672
 msgid "Cannot retrieve trusted domain GC list"
 msgstr ""
 
-#: ipaserver/dcerpc.py:713
+#: ipaserver/dcerpc.py:816
 msgid "CIFS credentials object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:750
+#: ipaserver/dcerpc.py:854
 #, python-format
 msgid "CIFS server %(host)s denied your credentials"
 msgstr ""
 
-#: ipaserver/dcerpc.py:754
+#: ipaserver/dcerpc.py:858
 #, python-format
 msgid "Cannot establish LSA connection to %(host)s. Is CIFS server running?"
 msgstr ""
 
-#: ipaserver/dcerpc.py:955
+#: ipaserver/dcerpc.py:1056
 #, python-format
 msgid ""
 "the IPA server and the remote domain cannot share the same NetBIOS name: %s"
 msgstr ""
 
-#: ipaserver/dcerpc.py:1035
+#: ipaserver/dcerpc.py:1157
 #, python-format
 msgid ""
 "IPA master denied trust validation requests from AD DC %(count)d times. Most "
 "likely AD DC contacted a replica that has no trust information replicated "
-"yet."
+"yet. Additionally, please check that AD DNS is able to resolve %(records)s "
+"SRV records to the correct IPA server."
 msgstr ""
 
-#: ipaserver/install/certs.py:409
+#: ipaserver/install/certs.py:408
 #, python-format
 msgid "Unable to communicate with CMS (%s)"
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:1321
+#: ipaserver/plugins/dogtag.py:1325
 msgid "Unable to communicate with CMS"
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:1853
+#: ipaserver/plugins/dogtag.py:1859
 msgid "find not supported on CAs upgraded from 9 to 10"
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:2018
+#: ipaserver/plugins/dogtag.py:2044
 msgid "Failed to authenticate to CA REST API"
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:2043
+#: ipaserver/plugins/dogtag.py:2069
 msgid "REST API is not logged in."
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:2060
+#: ipaserver/plugins/dogtag.py:2086
 #, python-format
 msgid ""
 "Non-2xx response from CA REST API: %(status)d %(status_text)s. "
 "%(explanation)s"
 msgstr ""
 
-#: ipaserver/plugins/join.py:59
+#: ipaserver/plugins/join.py:53
 msgid "The hostname to register as"
 msgstr ""
 
-#: ipaserver/plugins/join.py:68
+#: ipaserver/plugins/join.py:62
 msgid "The IPA realm"
 msgstr ""
 
-#: ipaserver/plugins/join.py:74
+#: ipaserver/plugins/join.py:68
 msgid "Hardware platform of the host (e.g. Lenovo T61)"
 msgstr ""
 
-#: ipaserver/plugins/join.py:78
+#: ipaserver/plugins/join.py:72
 msgid "Operating System and version of the host (e.g. Fedora 9)"
 msgstr ""
 
-#: ipaserver/plugins/join.py:118
+#: ipaserver/plugins/join.py:112
 #, python-format
 msgid ""
 "Insufficient 'write' privilege to the 'krbLastPwdChange' attribute of entry "
 "'%s'."
 msgstr ""
 
-#: ipaserver/plugins/ldap2.py:282
+#: ipaserver/plugins/ldap2.py:268
 msgid "Could not read UPG Definition originfilter. Check your permissions."
 msgstr ""
 
@@ -14798,308 +15472,323 @@ msgstr ""
 msgid "read error\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:63
+#: ipa-client/ipa-getkeytab.c:64
 #, c-format
 msgid "Kerberos context initialization failed: %1$s (%2$d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:74
+#: ipa-client/ipa-getkeytab.c:75
 #, c-format
 msgid "Unable to parse principal: %1$s (%2$d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:129
+#: ipa-client/ipa-getkeytab.c:130
 #, c-format
 msgid "No keys accepted by KDC\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:144
+#: ipa-client/ipa-getkeytab.c:145
 #, c-format
 msgid "Out of memory \n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:170
+#: ipa-client/ipa-getkeytab.c:171
 #, c-format
 msgid "Unable to set LDAP_OPT_X_TLS_CERTIFICATE\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:176
+#: ipa-client/ipa-getkeytab.c:177
 #, c-format
 msgid "Unable to init for ldaps(636) connection\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:183
+#: ipa-client/ipa-getkeytab.c:184
 #, c-format
 msgid "Unable to set LDAP_OPT_X_TLS\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:189
+#: ipa-client/ipa-getkeytab.c:190
 #, c-format
 msgid "Unable to init for ldap(389) connection\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:195
+#: ipa-client/ipa-getkeytab.c:196
 #, c-format
 msgid "Unable to initialize ldap library!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:203 ipa-client/ipa-join.c:243
+#: ipa-client/ipa-getkeytab.c:204 ipa-client/ipa-join.c:243
 #, c-format
 msgid "Unable to set LDAP_OPT_X_SASL_NOCANON\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:211
+#: ipa-client/ipa-getkeytab.c:212
 #, c-format
 msgid "Unable to set LDAP_OPT_PROTOCOL_VERSION\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:222
+#: ipa-client/ipa-getkeytab.c:223
 #, c-format
 msgid "Simple bind failed\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:265
+#: ipa-client/ipa-getkeytab.c:266
 #, c-format
 msgid "Operation failed: %s\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:274
+#: ipa-client/ipa-getkeytab.c:275
 #, c-format
 msgid "Failed to get result: %s\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:280
+#: ipa-client/ipa-getkeytab.c:281
 #, c-format
 msgid "Failed to parse extended result: %s\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:287
+#: ipa-client/ipa-getkeytab.c:288
 #, c-format
 msgid "Failed to parse result: %s\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:306
+#: ipa-client/ipa-getkeytab.c:307
 #, c-format
 msgid "Missing reply control list!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:316
+#: ipa-client/ipa-getkeytab.c:317
 #, c-format
 msgid "Missing reply control!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:356
+#: ipa-client/ipa-getkeytab.c:357
 #, c-format
 msgid "Out of Memory!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:363 ipa-client/ipa-getkeytab.c:522
+#: ipa-client/ipa-getkeytab.c:364 ipa-client/ipa-getkeytab.c:523
 #, c-format
 msgid "Failed to create control!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:369 ipa-client/ipa-getkeytab.c:529
+#: ipa-client/ipa-getkeytab.c:370 ipa-client/ipa-getkeytab.c:530
 #, c-format
 msgid "Failed to bind to server!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:376
+#: ipa-client/ipa-getkeytab.c:377
 #, c-format
 msgid "Failed to get keytab!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:385
+#: ipa-client/ipa-getkeytab.c:386
 #, c-format
 msgid "ber_init() failed, Invalid control ?!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:404
+#: ipa-client/ipa-getkeytab.c:405
 #, c-format
 msgid "ber_scanf() failed, unable to find kvno ?!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:416
+#: ipa-client/ipa-getkeytab.c:417
 #, c-format
 msgid "Failed to retrieve encryption type type #%d\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:420
+#: ipa-client/ipa-getkeytab.c:421
 #, c-format
 msgid "Failed to retrieve encryption type %1$s (#%2$d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:430
+#: ipa-client/ipa-getkeytab.c:431
 #, c-format
 msgid "Failed to retrieve any keys"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:544
+#: ipa-client/ipa-getkeytab.c:545
 msgid "Failed to decode control reply!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:572
+#: ipa-client/ipa-getkeytab.c:573
 msgid "New Principal Password"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:578
+#: ipa-client/ipa-getkeytab.c:579
 msgid "Verify Principal Password"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:613
+#: ipa-client/ipa-getkeytab.c:612
+#, c-format
+msgid "Failed to open config file %s\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:622
+#, c-format
+msgid "Failed to parse config file %s\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:689
 msgid "Print as little as possible"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:613
+#: ipa-client/ipa-getkeytab.c:689
 msgid "Output only on errors"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:615
+#: ipa-client/ipa-getkeytab.c:691
 msgid "Contact this specific KDC Server"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:616
+#: ipa-client/ipa-getkeytab.c:692
 msgid "Server Name"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:618
+#: ipa-client/ipa-getkeytab.c:694
 msgid "The principal to get a keytab for (ex: ftp/ftp.example.com@EXAMPLE.COM)"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:619 ipa-client/ipa-rmkeytab.c:172
+#: ipa-client/ipa-getkeytab.c:695 ipa-client/ipa-rmkeytab.c:172
 msgid "Kerberos Service Principal Name"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:621
+#: ipa-client/ipa-getkeytab.c:697
 msgid "File were to store the keytab information"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:622 ipa-client/ipa-rmkeytab.c:174
+#: ipa-client/ipa-getkeytab.c:698 ipa-client/ipa-rmkeytab.c:174
 msgid "Keytab File Name"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:624
+#: ipa-client/ipa-getkeytab.c:700
 msgid "Encryption types to request"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:625
+#: ipa-client/ipa-getkeytab.c:701
 msgid "Comma separated encryption types list"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:627
+#: ipa-client/ipa-getkeytab.c:703
 msgid "Show the list of permitted encryption types and exit"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:628
+#: ipa-client/ipa-getkeytab.c:704
 msgid "Permitted Encryption Types"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:630
+#: ipa-client/ipa-getkeytab.c:706
 msgid "Asks for a non-random password to use for the principal"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:632
+#: ipa-client/ipa-getkeytab.c:708
 msgid "LDAP DN"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:632
+#: ipa-client/ipa-getkeytab.c:708
 msgid "DN to bind as if not using kerberos"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:634
+#: ipa-client/ipa-getkeytab.c:710
 msgid "LDAP password"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:634
+#: ipa-client/ipa-getkeytab.c:710
 msgid "password to use if not using kerberos"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:636
+#: ipa-client/ipa-getkeytab.c:712
 msgid "Retrieve current keys without changing them"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:661 ipa-client/ipa-rmkeytab.c:190
+#: ipa-client/ipa-getkeytab.c:737 ipa-client/ipa-rmkeytab.c:190
 #, c-format
 msgid "Kerberos context initialization failed\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:674 util/ipa_krb5.c:878
+#: ipa-client/ipa-getkeytab.c:750 util/ipa_krb5.c:878
 #, c-format
 msgid "No system preferred enctypes ?!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:677
+#: ipa-client/ipa-getkeytab.c:753
 #, c-format
 msgid "Supported encryption types:\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:681
+#: ipa-client/ipa-getkeytab.c:757
 #, c-format
 msgid "Warning: failed to convert type (#%d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:700
+#: ipa-client/ipa-getkeytab.c:776
 #, c-format
 msgid "Bind password required when using a bind DN.\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:707
+#: ipa-client/ipa-getkeytab.c:792
+#, c-format
+msgid "Server name not provided and unavailable\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:798
 #, c-format
 msgid "Incompatible options provided (-r and -P)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:718
+#: ipa-client/ipa-getkeytab.c:809
 #, c-format
 msgid ""
 "Warning: salt types are not honored with randomized passwords (see opt. -P)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:730
+#: ipa-client/ipa-getkeytab.c:821
 #, c-format
 msgid "Invalid Service Principal Name\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:738
+#: ipa-client/ipa-getkeytab.c:829
 #, c-format
 msgid "Kerberos Credential Cache not found. Do you have a Kerberos Ticket?\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:746
+#: ipa-client/ipa-getkeytab.c:837
 #, c-format
 msgid ""
 "Kerberos User Principal not found. Do you have a valid Credential Cache?\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:754
+#: ipa-client/ipa-getkeytab.c:845
 #, c-format
 msgid "Failed to open Keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:771
+#: ipa-client/ipa-getkeytab.c:862
 #, c-format
 msgid "Retrying with pre-4.0 keytab retrieval method...\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:781
+#: ipa-client/ipa-getkeytab.c:872
 #, c-format
 msgid "Failed to create key material\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:789
+#: ipa-client/ipa-getkeytab.c:880
 #, c-format
 msgid "Failed to get keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:803
+#: ipa-client/ipa-getkeytab.c:894
 #, c-format
 msgid "Failed to add key to the keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:812
+#: ipa-client/ipa-getkeytab.c:903
 #, c-format
 msgid "Failed to close the keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:818
+#: ipa-client/ipa-getkeytab.c:909
 #, c-format
 msgid "Keytab successfully retrieved and stored in: %s\n"
 msgstr ""