Update translations

Pull fresh translations from Transifex. Update the POT file. Thanks to all translators!
author: Petr Viktorin <pviktori+transifex@redhat.com> 2014-06-27 16:33:47 +0200
committer: Petr Viktorin <pviktori@redhat.com> 2014-06-27 16:40:02 +0200
commit: 36d261e843dd6e8197e6f3ea16a97370215b50c2 (patch)
tree: ec77567bd8d5a915cbaebcc16417c167e9b35c63 /install/po/ipa.pot
parent: bd29d3cbbc91bc547fd52e96a8facbdcda91773c (diff)
download: freeipa-36d261e843dd6e8197e6f3ea16a97370215b50c2.tar.gz
freeipa-36d261e843dd6e8197e6f3ea16a97370215b50c2.tar.xz
freeipa-36d261e843dd6e8197e6f3ea16a97370215b50c2.zip
1 files changed, 3649 insertions, 2297 deletions
diff --git a/install/po/ipa.pot b/install/po/ipa.pot
index 4ddd97f13..a6595ca03 100644
--- a/install/po/ipa.pot
+++ b/install/po/ipa.pot
@@ -9,7 +9,7 @@ msgstr ""
 "Project-Id-Version: ipa\n"
 "Report-Msgid-Bugs-To: https://hosted.fedoraproject.org/projects/freeipa/"
 "newticket\n"
-"POT-Creation-Date: 2013-09-12 15:37+0200\n"
+"POT-Creation-Date: 2014-06-27 16:29+0200\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"
@@ -19,49 +19,58 @@ msgstr ""
 "Content-Transfer-Encoding: 8bit\n"
 "Plural-Forms: nplurals=INTEGER; plural=EXPRESSION;\n"
 
-#: ipalib/cli.py:593
+#: ipalib/cli.py:599
 #, python-format
 msgid "Enter %(label)s again to verify: "
 msgstr ""
 
-#: ipalib/cli.py:601 ipa-client/ipa-getkeytab.c:420
+#: ipalib/cli.py:607 ipa-client/ipa-getkeytab.c:739
 #, c-format
 msgid "Passwords do not match!"
 msgstr ""
 
-#: ipalib/cli.py:624
+#: ipalib/cli.py:630
 msgid "No matching entries found"
 msgstr ""
 
-#: ipalib/cli.py:668
+#: ipalib/cli.py:674
 msgid "Topic or Command"
 msgstr ""
 
-#: ipalib/cli.py:669
+#: ipalib/cli.py:675
 msgid "The topic or command name."
 msgstr ""
 
-#: ipalib/cli.py:833
+#: ipalib/cli.py:844
 msgid "Topic commands:"
 msgstr ""
 
-#: ipalib/cli.py:838
+#: ipalib/cli.py:849
 msgid "To get command help, use:"
 msgstr ""
 
-#: ipalib/cli.py:839
+#: ipalib/cli.py:850
 msgid "  ipa <command> --help"
 msgstr ""
 
-#: ipalib/cli.py:848
+#: ipalib/cli.py:859
 msgid "Command name"
 msgstr ""
 
-#: ipalib/cli.py:998
+#: ipalib/cli.py:1027
 msgid "Positional arguments"
 msgstr ""
 
-#: ipalib/cli.py:1254
+#: ipalib/cli.py:1175
+#, python-format
+msgid "Same as --%s"
+msgstr ""
+
+#: ipalib/cli.py:1178
+msgid "Deprecated options"
+msgstr ""
+
+#: ipalib/cli.py:1300
 msgid "No file to read"
 msgstr ""
 
@@ -69,375 +78,385 @@ msgstr ""
 msgid "A string searched in all relevant object attributes"
 msgstr ""
 
-#: ipalib/errors.py:269
+#: ipalib/errors.py:270
 #, python-format
 msgid "%(cver)s client incompatible with %(sver)s server at '%(server)s'"
 msgstr ""
 
-#: ipalib/errors.py:287
+#: ipalib/errors.py:288
 #, python-format
 msgid "unknown error %(code)d from %(server)s: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:303
+#: ipalib/errors.py:304
 msgid "an internal error has occurred"
 msgstr ""
 
-#: ipalib/errors.py:325
+#: ipalib/errors.py:326
 #, python-format
 msgid "an internal error has occurred on server at '%(server)s'"
 msgstr ""
 
-#: ipalib/errors.py:341
+#: ipalib/errors.py:342
 #, python-format
 msgid "unknown command '%(name)s'"
 msgstr ""
 
-#: ipalib/errors.py:358 ipalib/errors.py:383
+#: ipalib/errors.py:359 ipalib/errors.py:384
 #, python-format
 msgid "error on server '%(server)s': %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:374
+#: ipalib/errors.py:375
 #, python-format
 msgid "cannot connect to '%(uri)s': %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:392
+#: ipalib/errors.py:393
 #, python-format
 msgid "Invalid JSON-RPC request: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:408
+#: ipalib/errors.py:409
 #, python-format
 msgid "error marshalling data for XML-RPC transport: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:424
+#: ipalib/errors.py:425
 #, python-format
 msgid "Missing or invalid HTTP Referer, %(referer)s"
 msgstr ""
 
-#: ipalib/errors.py:451
+#: ipalib/errors.py:452
 #, python-format
 msgid "Kerberos error: %(major)s/%(minor)s"
 msgstr ""
 
-#: ipalib/errors.py:468
+#: ipalib/errors.py:469
 msgid "did not receive Kerberos credentials"
 msgstr ""
 
-#: ipalib/errors.py:484
+#: ipalib/errors.py:485
 #, python-format
 msgid "Service '%(service)s' not found in Kerberos database"
 msgstr ""
 
-#: ipalib/errors.py:500
+#: ipalib/errors.py:501
 msgid "No credentials cache found"
 msgstr ""
 
-#: ipalib/errors.py:516
+#: ipalib/errors.py:517
 msgid "Ticket expired"
 msgstr ""
 
-#: ipalib/errors.py:532
+#: ipalib/errors.py:533
 msgid "Credentials cache permissions incorrect"
 msgstr ""
 
-#: ipalib/errors.py:548
+#: ipalib/errors.py:549
 msgid "Bad format in credentials cache"
 msgstr ""
 
-#: ipalib/errors.py:564
+#: ipalib/errors.py:565
 msgid "Cannot resolve KDC for requested realm"
 msgstr ""
 
-#: ipalib/errors.py:576
+#: ipalib/errors.py:577
 msgid "Session error"
 msgstr ""
 
-#: ipalib/errors.py:584
+#: ipalib/errors.py:585
 #, python-format
 msgid "Principal %(principal)s cannot be authenticated: %(message)s"
 msgstr ""
 
-#: ipalib/errors.py:602
+#: ipalib/errors.py:603
 #, python-format
 msgid "Insufficient access: %(info)s"
 msgstr ""
 
-#: ipalib/errors.py:646
+#: ipalib/errors.py:647
 #, python-format
 msgid "command '%(name)s' takes no arguments"
 msgstr ""
 
-#: ipalib/errors.py:666
+#: ipalib/errors.py:667
 #, python-format
 msgid "command '%(name)s' takes at most %(count)d argument"
 msgid_plural "command '%(name)s' takes at most %(count)d arguments"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/errors.py:696
+#: ipalib/errors.py:697
 #, python-format
 msgid "overlapping arguments and options: %(names)s"
 msgstr ""
 
-#: ipalib/errors.py:712
+#: ipalib/errors.py:713
 #, python-format
 msgid "'%(name)s' is required"
 msgstr ""
 
-#: ipalib/errors.py:728 ipalib/errors.py:744
+#: ipalib/errors.py:729 ipalib/errors.py:745
 #, python-format
 msgid "invalid '%(name)s': %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:760
+#: ipalib/errors.py:761
 #, python-format
 msgid "api has no such namespace: '%(name)s'"
 msgstr ""
 
-#: ipalib/errors.py:769
+#: ipalib/errors.py:770
 msgid "Passwords do not match"
 msgstr ""
 
-#: ipalib/errors.py:778
+#: ipalib/errors.py:779
 msgid "Command not implemented"
 msgstr ""
 
-#: ipalib/errors.py:787
+#: ipalib/errors.py:788
 msgid "Client is not configured. Run ipa-client-install."
 msgstr ""
 
-#: ipalib/errors.py:796
+#: ipalib/errors.py:797
 #, python-format
 msgid "Could not get %(name)s interactively"
 msgstr ""
 
-#: ipalib/errors.py:811
+#: ipalib/errors.py:812
 #, python-format
 msgid "Command '%(name)s' has been deprecated"
 msgstr ""
 
-#: ipalib/errors.py:839 ipalib/errors.py:1079 ipalib/errors.py:1173
-#: ipalib/errors.py:1570 ipalib/errors.py:1587
+#: ipalib/errors.py:840 ipalib/errors.py:1080 ipalib/errors.py:1174
+#: ipalib/errors.py:1605 ipalib/errors.py:1622
 #, python-format
 msgid "%(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:855
+#: ipalib/errors.py:856
 msgid "This entry already exists"
 msgstr ""
 
-#: ipalib/errors.py:871
+#: ipalib/errors.py:872
 msgid "You must enroll a host in order to create a host service"
 msgstr ""
 
-#: ipalib/errors.py:887
+#: ipalib/errors.py:888
 #, python-format
 msgid ""
 "Service principal is not of the form: service/fully-qualified host name: "
 "%(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:903
+#: ipalib/errors.py:904
 msgid ""
 "The realm for the principal does not match the realm for this IPA server"
 msgstr ""
 
-#: ipalib/errors.py:919
+#: ipalib/errors.py:920
 msgid "This command requires root access"
 msgstr ""
 
-#: ipalib/errors.py:935
+#: ipalib/errors.py:936
 msgid "This is already a posix group"
 msgstr ""
 
-#: ipalib/errors.py:951
+#: ipalib/errors.py:952
 #, python-format
 msgid "Principal is not of the form user@REALM: '%(principal)s'"
 msgstr ""
 
-#: ipalib/errors.py:967
+#: ipalib/errors.py:968
 msgid "This entry is already enabled"
 msgstr ""
 
-#: ipalib/errors.py:983
+#: ipalib/errors.py:984
 msgid "This entry is already disabled"
 msgstr ""
 
-#: ipalib/errors.py:999
+#: ipalib/errors.py:1000
 msgid "This entry cannot be enabled or disabled"
 msgstr ""
 
-#: ipalib/errors.py:1015
+#: ipalib/errors.py:1016
 msgid "This entry is not a member"
 msgstr ""
 
-#: ipalib/errors.py:1031
+#: ipalib/errors.py:1032
 msgid "A group may not be a member of itself"
 msgstr ""
 
-#: ipalib/errors.py:1047
+#: ipalib/errors.py:1048
 msgid "This entry is already a member"
 msgstr ""
 
-#: ipalib/errors.py:1063
+#: ipalib/errors.py:1064
 #, python-format
 msgid "Base64 decoding failed: %(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:1095
+#: ipalib/errors.py:1096
 msgid "A group may not be added as a member of itself"
 msgstr ""
 
-#: ipalib/errors.py:1111
+#: ipalib/errors.py:1112
 msgid "The default users group cannot be removed"
 msgstr ""
 
-#: ipalib/errors.py:1127
+#: ipalib/errors.py:1128
 msgid "Host does not have corresponding DNS A record"
 msgstr ""
 
-#: ipalib/errors.py:1142
+#: ipalib/errors.py:1143
 msgid "Deleting a managed group is not allowed. It must be detached first."
 msgstr ""
 
-#: ipalib/errors.py:1157
+#: ipalib/errors.py:1158
 msgid "A managed group cannot have a password policy."
 msgstr ""
 
-#: ipalib/errors.py:1189
+#: ipalib/errors.py:1190
 #, python-format
 msgid "'%(entry)s' doesn't have a certificate."
 msgstr ""
 
-#: ipalib/errors.py:1205
+#: ipalib/errors.py:1206
 #, python-format
 msgid "Unable to create private group. A group '%(group)s' already exists."
 msgstr ""
 
-#: ipalib/errors.py:1221
+#: ipalib/errors.py:1222
 #, python-format
 msgid ""
 "A problem was encountered when verifying that all members were %(verb)s: "
 "%(exc)s"
 msgstr ""
 
-#: ipalib/errors.py:1239
+#: ipalib/errors.py:1240
 #, python-format
 msgid "%(attr)s does not contain '%(value)s'"
 msgstr ""
 
-#: ipalib/errors.py:1256
+#: ipalib/errors.py:1257
 #, python-format
 msgid ""
 "The search criteria was not specific enough. Expected 1 and found %(found)d."
 msgstr ""
 
-#: ipalib/errors.py:1273
+#: ipalib/errors.py:1274
 msgid "This group already allows external members"
 msgstr ""
 
-#: ipalib/errors.py:1290
+#: ipalib/errors.py:1291
 msgid "This group cannot be posix because it is external"
 msgstr ""
 
-#: ipalib/errors.py:1307
+#: ipalib/errors.py:1308
 msgid "This is already a posix group and cannot be converted to external one"
 msgstr ""
 
-#: ipalib/errors.py:1330
+#: ipalib/errors.py:1331
 #, python-format
 msgid "no command nor help topic '%(topic)s'"
 msgstr ""
 
-#: ipalib/errors.py:1354
+#: ipalib/errors.py:1355
 msgid "change collided with another change"
 msgstr ""
 
-#: ipalib/errors.py:1370
+#: ipalib/errors.py:1371
 msgid "no modifications to be performed"
 msgstr ""
 
-#: ipalib/errors.py:1386
+#: ipalib/errors.py:1387
 #, python-format
 msgid "%(desc)s: %(info)s"
 msgstr ""
 
-#: ipalib/errors.py:1402
+#: ipalib/errors.py:1403
 msgid "limits exceeded for this query"
 msgstr ""
 
-#: ipalib/errors.py:1417
+#: ipalib/errors.py:1418
 #, python-format
 msgid "%(info)s"
 msgstr ""
 
-#: ipalib/errors.py:1432
+#: ipalib/errors.py:1433
 msgid "modifying primary key is not allowed"
 msgstr ""
 
-#: ipalib/errors.py:1448
+#: ipalib/errors.py:1449
 #, python-format
 msgid "%(attr)s: Only one value allowed."
 msgstr ""
 
-#: ipalib/errors.py:1464
+#: ipalib/errors.py:1465
 #, python-format
 msgid "%(attr)s: Invalid syntax."
 msgstr ""
 
-#: ipalib/errors.py:1480
+#: ipalib/errors.py:1481
 #, python-format
 msgid "Bad search filter %(info)s"
 msgstr ""
 
-#: ipalib/errors.py:1496
+#: ipalib/errors.py:1497
 msgid "Not allowed on non-leaf entry"
 msgstr ""
 
-#: ipalib/errors.py:1512
+#: ipalib/errors.py:1513
 msgid "LDAP timeout"
 msgstr ""
 
-#: ipalib/errors.py:1537
+#: ipalib/errors.py:1531
+#, python-format
+msgid "DNS check failed: Expected {%(expected)s} got {%(got)s}"
+msgstr ""
+
+#: ipalib/errors.py:1547
+#, python-format
+msgid "%(task)s LDAP task timeout, Task DN: '%(task_dn)s'"
+msgstr ""
+
+#: ipalib/errors.py:1572
 #, python-format
 msgid "Certificate operation cannot be completed: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:1553
+#: ipalib/errors.py:1588
 #, python-format
 msgid "Certificate format error: %(error)s"
 msgstr ""
 
-#: ipalib/errors.py:1604
+#: ipalib/errors.py:1639
 msgid "Already registered"
 msgstr ""
 
-#: ipalib/errors.py:1620
+#: ipalib/errors.py:1655
 msgid "Not registered yet"
 msgstr ""
 
-#: ipalib/errors.py:1636
+#: ipalib/errors.py:1671
 #, python-format
 msgid "%(key)s cannot be deleted because %(label)s %(dependent)s requires it"
 msgstr ""
 
-#: ipalib/errors.py:1652
+#: ipalib/errors.py:1687
 #, python-format
 msgid ""
 "%(key)s cannot be deleted or disabled because it is the last member of "
 "%(label)s %(container)s"
 msgstr ""
 
-#: ipalib/errors.py:1668
+#: ipalib/errors.py:1703
 #, python-format
 msgid "%(label)s %(key)s cannot be deleted/modified: %(reason)s"
 msgstr ""
 
-#: ipalib/errors.py:1685
+#: ipalib/errors.py:1720
 #, python-format
 msgid "%(name)s certificate is not valid"
 msgstr ""
@@ -446,25 +465,25 @@ msgstr ""
 msgid "Results are truncated, try a more specific search"
 msgstr ""
 
-#: ipalib/frontend.py:531
+#: ipalib/frontend.py:535
 #, python-format
 msgid "Unknown option: %(option)s"
 msgstr ""
 
-#: ipalib/frontend.py:904
+#: ipalib/frontend.py:898
 msgid ""
 "Retrieve and print all attributes from the server. Affects command output."
 msgstr ""
 
-#: ipalib/frontend.py:910
+#: ipalib/frontend.py:904
 msgid "Print entries as stored on the server. Only affects output format."
 msgstr ""
 
-#: ipalib/frontend.py:916 ipalib/plugins/batch.py:69
+#: ipalib/frontend.py:910 ipalib/plugins/batch.py:73
 msgid "Client version. Used to determine if server will accept request."
 msgstr ""
 
-#: ipalib/frontend.py:1089
+#: ipalib/frontend.py:1087
 msgid "Forward to server instead of running locally"
 msgstr ""
 
@@ -479,402 +498,512 @@ msgid ""
 "Assuming server's API version, %(server_version)s"
 msgstr ""
 
-#: ipalib/output.py:92
+#: ipalib/output.py:93
 msgid "A dictionary representing an LDAP entry"
 msgstr ""
 
-#: ipalib/output.py:100
+#: ipalib/output.py:101
 msgid "A list of LDAP entries"
 msgstr ""
 
-#: ipalib/output.py:111
+#: ipalib/output.py:153
 msgid "All commands should at least have a result"
 msgstr ""
 
-#: ipalib/output.py:114
+#: ipalib/output.py:156
 msgid "User-friendly description of action performed"
 msgstr ""
 
-#: ipalib/output.py:118
+#: ipalib/output.py:160
 msgid "The primary_key value of the entry, e.g. 'jdoe' for a user"
 msgstr ""
 
-#: ipalib/output.py:133
+#: ipalib/output.py:175
 msgid "Number of entries returned"
 msgstr ""
 
-#: ipalib/output.py:134
+#: ipalib/output.py:176
 msgid "True if not all results were returned"
 msgstr ""
 
-#: ipalib/output.py:139
+#: ipalib/output.py:181 ipalib/output.py:187
 msgid "List of deletions that failed"
 msgstr ""
 
-#: ipalib/output.py:145
+#: ipalib/output.py:193 ipalib/plugins/dns.py:266
 msgid "True means the operation was successful"
 msgstr ""
 
-#: ipalib/parameters.py:370
+#: ipalib/parameters.py:382
 msgid "incorrect type"
 msgstr ""
 
-#: ipalib/parameters.py:373
+#: ipalib/parameters.py:385
 msgid "Only one value is allowed"
 msgstr ""
 
-#: ipalib/parameters.py:932
+#: ipalib/parameters.py:953
 msgid "must be True or False"
 msgstr ""
 
-#: ipalib/parameters.py:1033
+#: ipalib/parameters.py:1055
 msgid "must be an integer"
 msgstr ""
 
-#: ipalib/parameters.py:1084
+#: ipalib/parameters.py:1103
 #, python-format
 msgid "must be at least %(minvalue)d"
 msgstr ""
 
-#: ipalib/parameters.py:1094
+#: ipalib/parameters.py:1113
 #, python-format
 msgid "can be at most %(maxvalue)d"
 msgstr ""
 
-#: ipalib/parameters.py:1135
+#: ipalib/parameters.py:1129
 msgid "must be a decimal number"
 msgstr ""
 
-#: ipalib/parameters.py:1181
+#: ipalib/parameters.py:1175
 #, python-format
 msgid "must be at least %(minvalue)s"
 msgstr ""
 
-#: ipalib/parameters.py:1191
+#: ipalib/parameters.py:1185
 #, python-format
 msgid "can be at most %(maxvalue)s"
 msgstr ""
 
-#: ipalib/parameters.py:1199
+#: ipalib/parameters.py:1193
 #, python-format
 msgid ""
 "number class '%(cls)s' is not included in a list of allowed number classes: "
 "%(allowed)s"
 msgstr ""
 
-#: ipalib/parameters.py:1323
+#: ipalib/parameters.py:1317
 #, python-format
 msgid "must match pattern \"%(pattern)s\""
 msgstr ""
 
-#: ipalib/parameters.py:1341
+#: ipalib/parameters.py:1335
 msgid "must be binary data"
 msgstr ""
 
-#: ipalib/parameters.py:1357
+#: ipalib/parameters.py:1351
 #, python-format
 msgid "must be at least %(minlength)d bytes"
 msgstr ""
 
-#: ipalib/parameters.py:1367
+#: ipalib/parameters.py:1361
 #, python-format
 msgid "can be at most %(maxlength)d bytes"
 msgstr ""
 
-#: ipalib/parameters.py:1377
+#: ipalib/parameters.py:1371
 #, python-format
 msgid "must be exactly %(length)d bytes"
 msgstr ""
 
-#: ipalib/parameters.py:1407
+#: ipalib/parameters.py:1401
 msgid "must be Unicode text"
 msgstr ""
 
-#: ipalib/parameters.py:1440
+#: ipalib/parameters.py:1434
 msgid "Leading and trailing spaces are not allowed"
 msgstr ""
 
-#: ipalib/parameters.py:1448
+#: ipalib/parameters.py:1442
 #, python-format
 msgid "must be at least %(minlength)d characters"
 msgstr ""
 
-#: ipalib/parameters.py:1458
+#: ipalib/parameters.py:1452
 #, python-format
 msgid "can be at most %(maxlength)d characters"
 msgstr ""
 
-#: ipalib/parameters.py:1468
+#: ipalib/parameters.py:1462
 #, python-format
 msgid "must be exactly %(length)d characters"
 msgstr ""
 
-#: ipalib/parameters.py:1487
+#: ipalib/parameters.py:1483
 #, python-format
 msgid "The character %(char)r is not allowed."
 msgstr ""
 
-#: ipalib/parameters.py:1538
+#: ipalib/parameters.py:1534
 #, python-format
 msgid "must be '%(value)s'"
 msgstr ""
 
-#: ipalib/parameters.py:1541
+#: ipalib/parameters.py:1537
 #, python-format
 msgid "must be one of %(values)s"
 msgstr ""
 
-#: ipalib/parameters.py:1780
+#: ipalib/parameters.py:1647
+msgid "must be datetime value"
+msgstr ""
+
+#: ipalib/parameters.py:1661
+msgid "does not match any of accepted formats: "
+msgstr ""
+
+#: ipalib/parameters.py:1846
 msgid "incomplete time value"
 msgstr ""
 
-#: ipalib/parameters.py:1817
+#: ipalib/parameters.py:1883
 msgid "this option is deprecated"
 msgstr ""
 
-#: ipalib/plugins/aci.py:154
+#: ipalib/parameters.py:1936
+msgid "must be DNS name"
+msgstr ""
+
+#: ipalib/parameters.py:1955
+msgid "invalid escape code in domain name"
+msgstr ""
+
+#: ipalib/parameters.py:1957 ipalib/util.py:240
+msgid "empty DNS label"
+msgstr ""
+
+#: ipalib/parameters.py:1959
+msgid "domain name cannot be longer than 255 characters"
+msgstr ""
+
+#: ipalib/parameters.py:1961
+msgid "DNS label cannot be longer than 63 characters"
+msgstr ""
+
+#: ipalib/parameters.py:1963
+msgid "invalid domain name"
+msgstr ""
+
+#: ipalib/parameters.py:1970
+#, python-format
+msgid ""
+"domain name '%(domain)s' and normalized domain name '%(normalized)s' do not "
+"match. Please use only normalized domains"
+msgstr ""
+
+#: ipalib/parameters.py:1986
+msgid "must be absolute"
+msgstr ""
+
+#: ipalib/parameters.py:1990
+msgid "must be relative"
+msgstr ""
+
+#: ipalib/plugins/aci.py:157
 msgid "A list of ACI values"
 msgstr ""
 
-#: ipalib/plugins/aci.py:218
+#: ipalib/plugins/aci.py:221
 msgid "type, filter, subtree and targetgroup are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/aci.py:221
+#: ipalib/plugins/aci.py:224
 msgid "ACI prefix is required"
 msgstr ""
 
-#: ipalib/plugins/aci.py:224
+#: ipalib/plugins/aci.py:227
 msgid ""
 "at least one of: type, filter, subtree, targetgroup, attrs or memberof are "
 "required"
 msgstr ""
 
-#: ipalib/plugins/aci.py:227
+#: ipalib/plugins/aci.py:230
 msgid "filter and memberof are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/aci.py:233
+#: ipalib/plugins/aci.py:236
 msgid "group, permission and self are mutually exclusive"
 msgstr ""
 
-#: ipalib/plugins/aci.py:235
+#: ipalib/plugins/aci.py:238
 msgid "One of group, permission or self is required"
 msgstr ""
 
-#: ipalib/plugins/aci.py:258
+#: ipalib/plugins/aci.py:261
 #, python-format
 msgid "Group '%s' does not exist"
 msgstr ""
 
-#: ipalib/plugins/aci.py:284
+#: ipalib/plugins/aci.py:287
 msgid "empty filter"
 msgstr ""
 
-#: ipalib/plugins/aci.py:305
+#: ipalib/plugins/aci.py:308
 #, python-format
 msgid "Syntax Error: %(error)s"
 msgstr ""
 
-#: ipalib/plugins/aci.py:351
+#: ipalib/plugins/aci.py:354
 #, python-format
 msgid "invalid DN (%s)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:398
+#: ipalib/plugins/aci.py:401
 #, python-format
 msgid "ACI with name \"%s\" not found"
 msgstr ""
 
-#: ipalib/plugins/aci.py:416
+#: ipalib/plugins/aci.py:419
 msgid "ACI prefix"
 msgstr ""
 
-#: ipalib/plugins/aci.py:417
+#: ipalib/plugins/aci.py:420
 msgid ""
 "Prefix used to distinguish ACI types (permission, delegation, selfservice, "
 "none)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:428
+#: ipalib/plugins/aci.py:433
 msgid "ACIs"
 msgstr ""
 
-#: ipalib/plugins/aci.py:433
+#: ipalib/plugins/aci.py:438
 msgid "ACI name"
 msgstr ""
 
-#: ipalib/plugins/aci.py:439 ipalib/plugins/permission.py:123
+#: ipalib/plugins/aci.py:444 ipalib/plugins/permission.py:219
 msgid "Permission"
 msgstr ""
 
-#: ipalib/plugins/aci.py:440
+#: ipalib/plugins/aci.py:445
 msgid "Permission ACI grants access to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:445 ipalib/plugins/delegation.py:101
+#: ipalib/plugins/aci.py:450 ipalib/plugins/delegation.py:105
 msgid "User group"
 msgstr ""
 
-#: ipalib/plugins/aci.py:446 ipalib/plugins/delegation.py:102
+#: ipalib/plugins/aci.py:451 ipalib/plugins/delegation.py:106
 msgid "User group ACI grants access to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:451 ipalib/plugins/baseldap.py:65
-#: ipalib/plugins/delegation.py:83 ipalib/plugins/permission.py:122
-#: ipalib/plugins/permission.py:135 ipalib/plugins/selfservice.py:87
+#: ipalib/plugins/aci.py:456 ipalib/plugins/baseldap.py:67
+#: ipalib/plugins/delegation.py:87 ipalib/plugins/permission.py:218
+#: ipalib/plugins/selfservice.py:91
 msgid "Permissions"
 msgstr ""
 
-#: ipalib/plugins/aci.py:452
+#: ipalib/plugins/aci.py:457
 msgid "Permissions to grant(read, write, add, delete, all)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:460 ipalib/plugins/permission.py:143
+#: ipalib/plugins/aci.py:465
 msgid "Attributes to which the permission applies"
 msgstr ""
 
-#: ipalib/plugins/aci.py:461 ipalib/plugins/delegation.py:89
-#: ipalib/plugins/permission.py:142 ipalib/plugins/selfservice.py:93
+#: ipalib/plugins/aci.py:466 ipalib/plugins/delegation.py:93
+#: ipalib/plugins/selfservice.py:97
 msgid "Attributes"
 msgstr ""
 
-#: ipalib/plugins/aci.py:467 ipalib/plugins/permission.py:150
+#: ipalib/plugins/aci.py:472 ipalib/plugins/otptoken.py:141
+#: ipalib/plugins/permission.py:315
 msgid "Type"
 msgstr ""
 
-#: ipalib/plugins/aci.py:468
+#: ipalib/plugins/aci.py:473
 msgid "type of IPA object (user, group, host, hostgroup, service, netgroup)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:474
+#: ipalib/plugins/aci.py:479
 msgid "Member of"
 msgstr ""
 
-#: ipalib/plugins/aci.py:475
+#: ipalib/plugins/aci.py:480
 msgid "Member of a group"
 msgstr ""
 
-#: ipalib/plugins/aci.py:480 ipalib/plugins/permission.py:163
+#: ipalib/plugins/aci.py:485 ipalib/plugins/internal.py:206
 msgid "Filter"
 msgstr ""
 
-#: ipalib/plugins/aci.py:481 ipalib/plugins/permission.py:164
+#: ipalib/plugins/aci.py:486
 msgid "Legal LDAP filter (e.g. ou=Engineering)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:486 ipalib/plugins/permission.py:169
+#: ipalib/plugins/aci.py:491 ipalib/plugins/permission.py:277
 msgid "Subtree"
 msgstr ""
 
-#: ipalib/plugins/aci.py:487
+#: ipalib/plugins/aci.py:492
 msgid "Subtree to apply ACI to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:492 ipalib/plugins/permission.py:175
+#: ipalib/plugins/aci.py:497 ipalib/plugins/permission.py:309
 msgid "Target group"
 msgstr ""
 
-#: ipalib/plugins/aci.py:493
+#: ipalib/plugins/aci.py:498
 msgid "Group to apply ACI to"
 msgstr ""
 
-#: ipalib/plugins/aci.py:498
+#: ipalib/plugins/aci.py:503
 msgid "Target your own entry (self)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:499
+#: ipalib/plugins/aci.py:504
 msgid "Apply ACI to your own entry (self)"
 msgstr ""
 
-#: ipalib/plugins/aci.py:511
+#: ipalib/plugins/aci.py:516
 #, python-format
 msgid "Created ACI \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/aci.py:516
+#: ipalib/plugins/aci.py:521
 msgid "Test the ACI syntax but don't write anything"
 msgstr ""
 
-#: ipalib/plugins/aci.py:567
+#: ipalib/plugins/aci.py:571
 #, python-format
 msgid "Deleted ACI \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/aci.py:610 ipalib/plugins/aci.py:886
-#: ipalib/plugins/aci.py:927 ipalib/plugins/delegation.py:59
-#: ipalib/plugins/permission.py:88 ipalib/plugins/selfservice.py:60
+#: ipalib/plugins/aci.py:613 ipalib/plugins/aci.py:888
+#: ipalib/plugins/aci.py:934 ipalib/plugins/delegation.py:62
+#: ipalib/plugins/permission.py:112 ipalib/plugins/selfservice.py:63
 msgid "ACI"
 msgstr ""
 
-#: ipalib/plugins/aci.py:618
+#: ipalib/plugins/aci.py:621
 #, python-format
 msgid "Modified ACI \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/aci.py:693
+#: ipalib/plugins/aci.py:695
 #, python-format
 msgid "%(count)d ACI matched"
 msgid_plural "%(count)d ACIs matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/aci.py:934
+#: ipalib/plugins/aci.py:895
+msgid "Location of the ACI"
+msgstr ""
+
+#: ipalib/plugins/aci.py:941
 msgid "New ACI name"
 msgstr ""
 
-#: ipalib/plugins/aci.py:938
+#: ipalib/plugins/aci.py:945
 #, python-format
 msgid "Renamed ACI to \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:28
+#: ipalib/plugins/automember.py:30
 msgid ""
 "\n"
 "Auto Membership Rule.\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:32
+msgid ""
 "\n"
 "Bring clarity to the membership of hosts and users by configuring inclusive\n"
 "or exclusive regex patterns, you can automatically assign a new entries "
 "into\n"
 "a group or hostgroup based upon attribute information.\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:36
+msgid ""
 "\n"
 "A rule is directly associated with a group by name, so you cannot create\n"
 "a rule without an accompanying group or hostgroup.\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:39
+msgid ""
 "\n"
 "A condition is a regular expression used by 389-ds to match a new incoming\n"
 "entry with an automember rule. If it matches an inclusive rule then the\n"
 "entry is added to the appropriate group or hostgroup.\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:43
+msgid ""
 "\n"
 "A default group or hostgroup could be specified for entries that do not\n"
 "match any rule. In case of user entries this group will be a fallback group\n"
 "because all users are by default members of group specified in IPA config.\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:47
+msgid ""
 "\n"
+"The automember-rebuild command can be used to retroactively run automember "
+"rules\n"
+"against existing entries, thus rebuilding their membership.\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:50 ipalib/plugins/host.py:79
+#: ipalib/plugins/otptoken.py:46 ipalib/plugins/otptoken_yubikey.py:37
+#: ipalib/plugins/permission.py:90 ipalib/plugins/radiusproxy.py:35
+#: ipalib/plugins/sudorule.py:66
+msgid ""
 "\n"
 "EXAMPLES:\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:52
+msgid ""
 "\n"
 " Add the initial group or hostgroup:\n"
 "   ipa hostgroup-add --desc=\"Web Servers\" webservers\n"
 "   ipa group-add --desc=\"Developers\" devel\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:56
+msgid ""
 "\n"
 " Add the initial rule:\n"
 "   ipa automember-add --type=hostgroup webservers\n"
 "   ipa automember-add --type=group devel\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:60
+msgid ""
 "\n"
 " Add a condition to the rule:\n"
 "   ipa automember-add-condition --key=fqdn --type=hostgroup --inclusive-"
 "regex=^web[1-9]+\\.example\\.com webservers\n"
 "   ipa automember-add-condition --key=manager --type=group --inclusive-"
 "regex=^uid=mscott devel\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:64
+msgid ""
 "\n"
 " Add an exclusive condition to the rule to prevent auto assignment:\n"
 "   ipa automember-add-condition --key=fqdn --type=hostgroup --exclusive-"
 "regex=^web5\\.example\\.com webservers\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:67
+msgid ""
 "\n"
 " Add a host:\n"
 "    ipa host-add web1.example.com\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:70
+msgid ""
 "\n"
 " Add a user:\n"
 "    ipa user-add --first=Tim --last=User --password tuser1 --manager=mscott\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:73
+msgid ""
 "\n"
 " Verify automembership:\n"
 "    ipa hostgroup-show webservers\n"
@@ -887,152 +1016,214 @@ msgid ""
 "      Description: Developers\n"
 "      GID: 1004200000\n"
 "      Member users: tuser\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:85
+msgid ""
 "\n"
 " Remove a condition from the rule:\n"
 "   ipa automember-remove-condition --key=fqdn --type=hostgroup --inclusive-"
 "regex=^web[1-9]+\\.example\\.com webservers\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:88
+msgid ""
 "\n"
 " Modify the automember rule:\n"
 "    ipa automember-mod\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:91
+msgid ""
 "\n"
 " Set the default (fallback) target group:\n"
 "    ipa automember-default-group-set --default-group=webservers --"
 "type=hostgroup\n"
 "    ipa automember-default-group-set --default-group=ipausers --type=group\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:95
+msgid ""
 "\n"
 " Remove the default (fallback) target group:\n"
 "    ipa automember-default-group-remove --type=hostgroup\n"
 "    ipa automember-default-group-remove --type=group\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:99
+msgid ""
 "\n"
 " Show the default (fallback) target group:\n"
 "    ipa automember-default-group-show --type=hostgroup\n"
 "    ipa automember-default-group-show --type=group\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:103
+msgid ""
 "\n"
 " Find all of the automember rules:\n"
 "    ipa automember-find\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:106
+msgid ""
 "\n"
 " Display a automember rule:\n"
 "    ipa automember-show --type=hostgroup webservers\n"
 "    ipa automember-show --type=group devel\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:110
+msgid ""
 "\n"
 " Delete an automember rule:\n"
 "    ipa automember-del --type=hostgroup webservers\n"
 "    ipa automember-del --type=group devel\n"
 msgstr ""
 
-#: ipalib/plugins/automember.py:119 ipalib/plugins/automember.py:120
+#: ipalib/plugins/automember.py:114
+msgid ""
+"\n"
+" Rebuild membership for all users:\n"
+"    ipa automember-rebuild --type=group\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:117
+msgid ""
+"\n"
+" Rebuild membership for all hosts:\n"
+"    ipa automember-rebuild --type=hostgroup\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:120
+msgid ""
+"\n"
+" Rebuild membership for specified users:\n"
+"    ipa automember-rebuild --users=tuser1 --users=tuser2\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:123
+msgid ""
+"\n"
+" Rebuild membership for specified hosts:\n"
+"    ipa automember-rebuild --hosts=web1.example.com --hosts=web2.example."
+"com\n"
+msgstr ""
+
+#: ipalib/plugins/automember.py:142 ipalib/plugins/automember.py:143
 msgid "Inclusive Regex"
 msgstr ""
 
-#: ipalib/plugins/automember.py:126 ipalib/plugins/automember.py:127
+#: ipalib/plugins/automember.py:149 ipalib/plugins/automember.py:150
 msgid "Exclusive Regex"
 msgstr ""
 
-#: ipalib/plugins/automember.py:132
+#: ipalib/plugins/automember.py:155
 msgid "Attribute Key"
 msgstr ""
 
-#: ipalib/plugins/automember.py:133
+#: ipalib/plugins/automember.py:156
 msgid ""
 "Attribute to filter via regex. For example fqdn for a host, or manager for a "
 "user"
 msgstr ""
 
-#: ipalib/plugins/automember.py:140
+#: ipalib/plugins/automember.py:163
 msgid "Grouping Type"
 msgstr ""
 
-#: ipalib/plugins/automember.py:141
+#: ipalib/plugins/automember.py:164
 msgid "Grouping to which the rule applies"
 msgstr ""
 
-#: ipalib/plugins/automember.py:149 ipalib/plugins/automember.py:150
+#: ipalib/plugins/automember.py:172 ipalib/plugins/automember.py:173
 msgid "Automember Rule"
 msgstr ""
 
-#: ipalib/plugins/automember.py:171
+#: ipalib/plugins/automember.py:232
 msgid "Auto Membership Rule"
 msgstr ""
 
-#: ipalib/plugins/automember.py:176 ipalib/plugins/automount.py:579
-#: ipalib/plugins/group.py:155 ipalib/plugins/hbacrule.py:179
-#: ipalib/plugins/hbacsvc.py:79 ipalib/plugins/hbacsvcgroup.py:73
-#: ipalib/plugins/host.py:267 ipalib/plugins/hostgroup.py:90
-#: ipalib/plugins/netgroup.py:122 ipalib/plugins/privilege.py:73
-#: ipalib/plugins/role.py:92 ipalib/plugins/selinuxusermap.py:184
-#: ipalib/plugins/sudocmd.py:77 ipalib/plugins/sudocmdgroup.py:78
-#: ipalib/plugins/sudorule.py:111
+#: ipalib/plugins/automember.py:237 ipalib/plugins/automount.py:600
+#: ipalib/plugins/group.py:222 ipalib/plugins/hbacrule.py:233
+#: ipalib/plugins/hbacsvc.py:108 ipalib/plugins/hbacsvcgroup.py:112
+#: ipalib/plugins/host.py:385 ipalib/plugins/hostgroup.py:144
+#: ipalib/plugins/netgroup.py:179 ipalib/plugins/otptoken.py:149
+#: ipalib/plugins/privilege.py:107 ipalib/plugins/radiusproxy.py:109
+#: ipalib/plugins/role.py:139 ipalib/plugins/selinuxusermap.py:227
+#: ipalib/plugins/sudocmd.py:119 ipalib/plugins/sudocmdgroup.py:122
+#: ipalib/plugins/sudorule.py:223
 msgid "Description"
 msgstr ""
 
-#: ipalib/plugins/automember.py:177
+#: ipalib/plugins/automember.py:238
 msgid "A description of this auto member rule"
 msgstr ""
 
-#: ipalib/plugins/automember.py:181 ipalib/plugins/automember.py:511
+#: ipalib/plugins/automember.py:242 ipalib/plugins/automember.py:568
 msgid "Default (fallback) Group"
 msgstr ""
 
-#: ipalib/plugins/automember.py:182
+#: ipalib/plugins/automember.py:243
 msgid "Default group for entries to land"
 msgstr ""
 
-#: ipalib/plugins/automember.py:193
+#: ipalib/plugins/automember.py:255
 #, python-format
-msgid "Group: %s not found!"
+msgid "%(otype)s \"%(oname)s\" not found"
 msgstr ""
 
-#: ipalib/plugins/automember.py:217
+#: ipalib/plugins/automember.py:281
 #, python-format
 msgid "%s is not a valid attribute."
 msgstr ""
 
-#: ipalib/plugins/automember.py:230
+#: ipalib/plugins/automember.py:294
 msgid ""
 "\n"
 "    Add an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:235
+#: ipalib/plugins/automember.py:299
 #, python-format
 msgid "Added automember rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:242
+#: ipalib/plugins/automember.py:306
 msgid "Auto Membership is not configured"
 msgstr ""
 
-#: ipalib/plugins/automember.py:255
+#: ipalib/plugins/automember.py:318
 msgid ""
 "\n"
 "    Add conditions to an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:260
+#: ipalib/plugins/automember.py:323
 msgid "Failed to add"
 msgstr ""
 
-#: ipalib/plugins/automember.py:267
+#: ipalib/plugins/automember.py:330
 #, python-format
 msgid "Added condition(s) to \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:276
+#: ipalib/plugins/automember.py:339
 msgid "Conditions that could not be added"
 msgstr ""
 
-#: ipalib/plugins/automember.py:280
+#: ipalib/plugins/automember.py:343
 msgid "Number of conditions added"
 msgstr ""
 
-#: ipalib/plugins/automember.py:290 ipalib/plugins/automember.py:376
+#: ipalib/plugins/automember.py:353 ipalib/plugins/automember.py:438
 #, python-format
 msgid "Auto member rule: %s not found!"
 msgstr ""
 
-#: ipalib/plugins/automember.py:332
+#: ipalib/plugins/automember.py:395
 msgid ""
 "\n"
 "        Override this so we can add completed and failed to the return "
@@ -1040,119 +1231,196 @@ msgid ""
 "        "
 msgstr ""
 
-#: ipalib/plugins/automember.py:348
+#: ipalib/plugins/automember.py:410
 msgid ""
 "\n"
 "    Remove conditions from an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:353
+#: ipalib/plugins/automember.py:415
 #, python-format
 msgid "Removed condition(s) from \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:362
+#: ipalib/plugins/automember.py:424
 msgid "Conditions that could not be removed"
 msgstr ""
 
-#: ipalib/plugins/automember.py:366
+#: ipalib/plugins/automember.py:428
 msgid "Number of conditions removed"
 msgstr ""
 
-#: ipalib/plugins/automember.py:420
+#: ipalib/plugins/automember.py:482
 msgid ""
 "\n"
 "        Override this so we can set completed and failed.\n"
 "        "
 msgstr ""
 
-#: ipalib/plugins/automember.py:436
+#: ipalib/plugins/automember.py:497
 msgid ""
 "\n"
 "    Modify an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:441
+#: ipalib/plugins/automember.py:502
 #, python-format
 msgid "Modified automember rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:452
+#: ipalib/plugins/automember.py:512
 msgid ""
 "\n"
 "    Delete an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:457
+#: ipalib/plugins/automember.py:517
 #, python-format
 msgid "Deleted automember rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:468
+#: ipalib/plugins/automember.py:527
 msgid ""
 "\n"
 "    Search for automember rules.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:475
+#: ipalib/plugins/automember.py:534
 #, python-format
 msgid "%(count)d rules matched"
 msgid_plural "%(count)d rules matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automember.py:488
+#: ipalib/plugins/automember.py:546
 msgid ""
 "\n"
 "    Display information about an automember rule.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:504
+#: ipalib/plugins/automember.py:561
 msgid ""
 "\n"
 "    Set default (fallback) group for all unmatched entries.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:512
+#: ipalib/plugins/automember.py:569
 msgid "Default (fallback) group for entries to land"
 msgstr ""
 
-#: ipalib/plugins/automember.py:516
+#: ipalib/plugins/automember.py:573
 #, python-format
 msgid "Set default (fallback) group for automember \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:533
+#: ipalib/plugins/automember.py:589
 msgid ""
 "\n"
 "    Remove default (fallback) group for all unmatched entries.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automember.py:538
+#: ipalib/plugins/automember.py:594
 #, python-format
 msgid "Removed default (fallback) group for automember \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automember.py:548 ipalib/plugins/automember.py:556
-#: ipalib/plugins/automember.py:581
+#: ipalib/plugins/automember.py:604 ipalib/plugins/automember.py:612
+#: ipalib/plugins/automember.py:636
 msgid "No default (fallback) group set"
 msgstr ""
 
-#: ipalib/plugins/automember.py:568
+#: ipalib/plugins/automember.py:623
 msgid ""
 "\n"
 "    Display information about the default (fallback) automember groups.\n"
 "    "
 msgstr ""
 
-#: ipalib/plugins/automount.py:29
+#: ipalib/plugins/automember.py:647
+msgid "Rebuild auto membership."
+msgstr ""
+
+#: ipalib/plugins/automember.py:653
+msgid "Rebuild membership for all members of a grouping"
+msgstr ""
+
+#: ipalib/plugins/automember.py:657 ipalib/plugins/hbacrule.py:240
+#: ipalib/plugins/internal.py:512 ipalib/plugins/selinuxusermap.py:234
+#: ipalib/plugins/sudorule.py:267 ipalib/plugins/user.py:429
+msgid "Users"
+msgstr ""
+
+#: ipalib/plugins/automember.py:658
+msgid "Rebuild membership for specified users"
+msgstr ""
+
+#: ipalib/plugins/automember.py:662 ipalib/plugins/hbacrule.py:248
+#: ipalib/plugins/host.py:373 ipalib/plugins/internal.py:506
+#: ipalib/plugins/selinuxusermap.py:242 ipalib/plugins/sudorule.py:280
+msgid "Hosts"
+msgstr ""
+
+#: ipalib/plugins/automember.py:663
+msgid "Rebuild membership for specified hosts"
+msgstr ""
+
+#: ipalib/plugins/automember.py:668
+msgid "No wait"
+msgstr ""
+
+#: ipalib/plugins/automember.py:669
+msgid "Don't wait for rebuilding membership"
+msgstr ""
+
+#: ipalib/plugins/automember.py:676
+msgid "Task DN"
+msgstr ""
+
+#: ipalib/plugins/automember.py:677
+msgid "DN of the started task"
+msgstr ""
+
+#: ipalib/plugins/automember.py:694
+msgid "at least one of options: type, users, hosts must be specified"
+msgstr ""
+
+#: ipalib/plugins/automember.py:700
+msgid "users and hosts cannot both be set"
+msgstr ""
+
+#: ipalib/plugins/automember.py:704
+msgid "hosts cannot be set when type is 'group'"
+msgstr ""
+
+#: ipalib/plugins/automember.py:708
+msgid "users cannot be set when type is 'hostgroup'"
+msgstr ""
+
+#: ipalib/plugins/automember.py:759
+msgid "Automember rebuild membership task started"
+msgstr ""
+
+#: ipalib/plugins/automember.py:763 ipalib/plugins/internal.py:158
+msgid "Automember rebuild membership task completed"
+msgstr ""
+
+#: ipalib/plugins/automember.py:780
+#, python-format
+msgid "Task DN = '%s'"
+msgstr ""
+
+#: ipalib/plugins/automember.py:783 ipalib/plugins/internal.py:692
+msgid "Automember"
+msgstr ""
+
+#: ipalib/plugins/automount.py:30
 msgid ""
 "\n"
 "Automount\n"
@@ -1260,628 +1528,627 @@ msgid ""
 "    ipa automountkey-del baltimore auto.share --key=man\n"
 msgstr ""
 
-#: ipalib/plugins/automount.py:205
+#: ipalib/plugins/automount.py:209
 msgid "automount location"
 msgstr ""
 
-#: ipalib/plugins/automount.py:206
+#: ipalib/plugins/automount.py:210
 msgid "automount locations"
 msgstr ""
 
-#: ipalib/plugins/automount.py:209
+#: ipalib/plugins/automount.py:213
 msgid "Automount Locations"
 msgstr ""
 
-#: ipalib/plugins/automount.py:210
+#: ipalib/plugins/automount.py:214
 msgid "Automount Location"
 msgstr ""
 
-#: ipalib/plugins/automount.py:215 ipalib/plugins/host.py:277
+#: ipalib/plugins/automount.py:243 ipalib/plugins/host.py:395
 msgid "Location"
 msgstr ""
 
-#: ipalib/plugins/automount.py:216
+#: ipalib/plugins/automount.py:244
 msgid "Automount location name."
 msgstr ""
 
-#: ipalib/plugins/automount.py:225
+#: ipalib/plugins/automount.py:252
 msgid "Create a new automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:227
+#: ipalib/plugins/automount.py:254
 #, python-format
 msgid "Added automount location \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:247
+#: ipalib/plugins/automount.py:272
 msgid "Delete an automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:249
+#: ipalib/plugins/automount.py:274
 #, python-format
 msgid "Deleted automount location \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:255
+#: ipalib/plugins/automount.py:279
 msgid "Display an automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:261
+#: ipalib/plugins/automount.py:284
 msgid "Search for an automount location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:264
+#: ipalib/plugins/automount.py:287
 #, python-format
 msgid "%(count)d automount location matched"
 msgid_plural "%(count)d automount locations matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automount.py:272
+#: ipalib/plugins/automount.py:294
 msgid "Generate automount files for a specific location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:350
+#: ipalib/plugins/automount.py:372
 msgid "maps not connected to /etc/auto.master:"
 msgstr ""
 
-#: ipalib/plugins/automount.py:368
+#: ipalib/plugins/automount.py:389
 msgid "Import automount files for a specific location."
 msgstr ""
 
-#: ipalib/plugins/automount.py:372
+#: ipalib/plugins/automount.py:393
 msgid "Master file"
 msgstr ""
 
-#: ipalib/plugins/automount.py:373
+#: ipalib/plugins/automount.py:394
 msgid "Automount master file."
 msgstr ""
 
-#: ipalib/plugins/automount.py:380
+#: ipalib/plugins/automount.py:401
 msgid ""
 "Continuous operation mode. Errors are reported but the process continues."
 msgstr ""
 
-#: ipalib/plugins/automount.py:392
+#: ipalib/plugins/automount.py:413
 #, python-format
 msgid "File %(file)s not found"
 msgstr ""
 
-#: ipalib/plugins/automount.py:444
+#: ipalib/plugins/automount.py:465
 #, python-format
 msgid "key %(key)s already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:460
+#: ipalib/plugins/automount.py:481
 #, python-format
 msgid "map %(map)s already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:565
+#: ipalib/plugins/automount.py:585
 msgid "automount map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:566
+#: ipalib/plugins/automount.py:586
 msgid "automount maps"
 msgstr ""
 
-#: ipalib/plugins/automount.py:573
+#: ipalib/plugins/automount.py:594
 msgid "Map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:574
+#: ipalib/plugins/automount.py:595
 msgid "Automount map name."
 msgstr ""
 
-#: ipalib/plugins/automount.py:583
+#: ipalib/plugins/automount.py:629
 msgid "Automount Maps"
 msgstr ""
 
-#: ipalib/plugins/automount.py:584
+#: ipalib/plugins/automount.py:630
 msgid "Automount Map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:590
+#: ipalib/plugins/automount.py:635
 msgid "Create a new automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:592
+#: ipalib/plugins/automount.py:637
 #, python-format
 msgid "Added automount map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:598
+#: ipalib/plugins/automount.py:642
 msgid "Delete an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:600
+#: ipalib/plugins/automount.py:644
 #, python-format
 msgid "Deleted automount map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:619
+#: ipalib/plugins/automount.py:662
 msgid "Modify an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:621
+#: ipalib/plugins/automount.py:664
 #, python-format
 msgid "Modified automount map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:627
+#: ipalib/plugins/automount.py:669
 msgid "Search for an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:630
+#: ipalib/plugins/automount.py:672
 #, python-format
 msgid "%(count)d automount map matched"
 msgid_plural "%(count)d automount maps matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automount.py:638
+#: ipalib/plugins/automount.py:679
 msgid "Display an automount map."
 msgstr ""
 
-#: ipalib/plugins/automount.py:644
+#: ipalib/plugins/automount.py:684
 msgid "Automount key object."
 msgstr ""
 
-#: ipalib/plugins/automount.py:648
+#: ipalib/plugins/automount.py:688
 msgid "automount key"
 msgstr ""
 
-#: ipalib/plugins/automount.py:649
+#: ipalib/plugins/automount.py:689
 msgid "automount keys"
 msgstr ""
 
-#: ipalib/plugins/automount.py:660 ipalib/plugins/automount.py:883
-#: ipalib/plugins/automount.py:993
+#: ipalib/plugins/automount.py:701 ipalib/plugins/automount.py:950
+#: ipalib/plugins/automount.py:1057 ipalib/plugins/otptoken.py:191
 msgid "Key"
 msgstr ""
 
-#: ipalib/plugins/automount.py:661 ipalib/plugins/automount.py:884
-#: ipalib/plugins/automount.py:994
+#: ipalib/plugins/automount.py:702 ipalib/plugins/automount.py:951
+#: ipalib/plugins/automount.py:1058
 msgid "Automount key name."
 msgstr ""
 
-#: ipalib/plugins/automount.py:666 ipalib/plugins/automount.py:888
-#: ipalib/plugins/automount.py:998
+#: ipalib/plugins/automount.py:707 ipalib/plugins/automount.py:955
+#: ipalib/plugins/automount.py:1062
 msgid "Mount information"
 msgstr ""
 
-#: ipalib/plugins/automount.py:669
+#: ipalib/plugins/automount.py:710
 msgid "description"
 msgstr ""
 
-#: ipalib/plugins/automount.py:678
+#: ipalib/plugins/automount.py:748
 msgid "Automount Keys"
 msgstr ""
 
-#: ipalib/plugins/automount.py:679
+#: ipalib/plugins/automount.py:749
 msgid "Automount Key"
 msgstr ""
 
-#: ipalib/plugins/automount.py:680
+#: ipalib/plugins/automount.py:750
 #, python-format
 msgid ""
 "The key,info pair must be unique. A key named %(key)s with info %(info)s "
 "already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:681
+#: ipalib/plugins/automount.py:751
 #, python-format
 msgid "key named %(key)s already exists"
 msgstr ""
 
-#: ipalib/plugins/automount.py:682
+#: ipalib/plugins/automount.py:752
 #, python-format
 msgid "The automount key %(key)s with info %(info)s does not exist"
 msgstr ""
 
-#: ipalib/plugins/automount.py:732
+#: ipalib/plugins/automount.py:802
 #, python-format
 msgid ""
 "More than one entry with key %(key)s found, use --info to select specific "
 "entry."
 msgstr ""
 
-#: ipalib/plugins/automount.py:792
+#: ipalib/plugins/automount.py:861
 msgid "Create a new automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:794
+#: ipalib/plugins/automount.py:863
 #, python-format
 msgid "Added automount key \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:822
+#: ipalib/plugins/automount.py:890
 msgid "Create a new indirect mount point."
 msgstr ""
 
-#: ipalib/plugins/automount.py:824
+#: ipalib/plugins/automount.py:892
 #, python-format
 msgid "Added automount indirect map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:829
+#: ipalib/plugins/automount.py:897
 msgid "Mount point"
 msgstr ""
 
-#: ipalib/plugins/automount.py:833
+#: ipalib/plugins/automount.py:901
 msgid "Parent map"
 msgstr ""
 
-#: ipalib/plugins/automount.py:834
+#: ipalib/plugins/automount.py:902
 msgid "Name of parent automount map (default: auto.master)."
 msgstr ""
 
-#: ipalib/plugins/automount.py:848
+#: ipalib/plugins/automount.py:916
 msgid "mount point is relative to parent map, cannot begin with /"
 msgstr ""
 
-#: ipalib/plugins/automount.py:876
+#: ipalib/plugins/automount.py:943
 msgid "Delete an automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:878
+#: ipalib/plugins/automount.py:945
 #, python-format
 msgid "Deleted automount key \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:918
+#: ipalib/plugins/automount.py:984
 msgid "Modify an automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:920
+#: ipalib/plugins/automount.py:986
 #, python-format
 msgid "Modified automount key \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/automount.py:927
+#: ipalib/plugins/automount.py:993
 msgid "New mount information"
 msgstr ""
 
-#: ipalib/plugins/automount.py:977
+#: ipalib/plugins/automount.py:1042
 msgid "Search for an automount key."
 msgstr ""
 
-#: ipalib/plugins/automount.py:980
+#: ipalib/plugins/automount.py:1045
 #, python-format
 msgid "%(count)d automount key matched"
 msgid_plural "%(count)d automount keys matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/automount.py:988
+#: ipalib/plugins/automount.py:1052
 msgid "Display an automount key."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:41 ipalib/plugins/internal.py:280
-#: ipalib/plugins/internal.py:633 ipalib/plugins/migration.py:491
-#: ipalib/plugins/user.py:289
+#: ipalib/plugins/baseldap.py:43 ipalib/plugins/internal.py:292
+#: ipalib/plugins/internal.py:659 ipalib/plugins/migration.py:502
+#: ipalib/plugins/otptoken.py:442 ipalib/plugins/user.py:497
 msgid "Password"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:44
+#: ipalib/plugins/baseldap.py:46
 msgid "Failed members"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:47
+#: ipalib/plugins/baseldap.py:49
 msgid "Member users"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:50
+#: ipalib/plugins/baseldap.py:52
 msgid "Member groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:53
+#: ipalib/plugins/baseldap.py:55
 msgid "Member of groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:56
+#: ipalib/plugins/baseldap.py:58
 msgid "Member hosts"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:59
+#: ipalib/plugins/baseldap.py:61
 msgid "Member host-groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:62
+#: ipalib/plugins/baseldap.py:64
 msgid "Member of host-groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:71 ipalib/plugins/role.py:81
+#: ipalib/plugins/baseldap.py:73 ipalib/plugins/role.py:128
 msgid "Roles"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:74 ipalib/plugins/sudocmdgroup.py:66
-#: ipalib/plugins/sudocmdgroup.py:86
+#: ipalib/plugins/baseldap.py:76 ipalib/plugins/sudocmdgroup.py:110
+#: ipalib/plugins/sudocmdgroup.py:130
 msgid "Sudo Command Groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:80
+#: ipalib/plugins/baseldap.py:82
 msgid "Granting privilege to roles"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:83
+#: ipalib/plugins/baseldap.py:85
 msgid "Member netgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:86
+#: ipalib/plugins/baseldap.py:88
 msgid "Member of netgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:89
+#: ipalib/plugins/baseldap.py:91
 msgid "Member services"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:92
+#: ipalib/plugins/baseldap.py:94
 msgid "Member service groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:98
+#: ipalib/plugins/baseldap.py:100
 msgid "Member HBAC service"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:101
+#: ipalib/plugins/baseldap.py:103
 msgid "Member HBAC service groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:116
+#: ipalib/plugins/baseldap.py:118
 msgid "Indirect Member users"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:119
+#: ipalib/plugins/baseldap.py:121
 msgid "Indirect Member groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:122
+#: ipalib/plugins/baseldap.py:124
 msgid "Indirect Member hosts"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:125
+#: ipalib/plugins/baseldap.py:127
 msgid "Indirect Member host-groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:128
+#: ipalib/plugins/baseldap.py:130
 msgid "Indirect Member of roles"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:131
+#: ipalib/plugins/baseldap.py:133
 msgid "Indirect Member permissions"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:134
+#: ipalib/plugins/baseldap.py:136
 msgid "Indirect Member HBAC service"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:137
+#: ipalib/plugins/baseldap.py:139
 msgid "Indirect Member HBAC service group"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:140
+#: ipalib/plugins/baseldap.py:142
 msgid "Indirect Member netgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:161
+#: ipalib/plugins/baseldap.py:163
 msgid "Failed source hosts/hostgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:164
+#: ipalib/plugins/baseldap.py:166
 msgid "Failed hosts/hostgroups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:167
+#: ipalib/plugins/baseldap.py:169
 msgid "Failed users/groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:170
+#: ipalib/plugins/baseldap.py:172
 msgid "Failed service/service groups"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:173
+#: ipalib/plugins/baseldap.py:175
 msgid "Failed to remove"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:177
+#: ipalib/plugins/baseldap.py:179
 msgid "Failed RunAs"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:180
+#: ipalib/plugins/baseldap.py:182
 msgid "Failed RunAsGroup"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:198
+#: ipalib/plugins/baseldap.py:200
 msgid "Invalid format. Should be name=value"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:286
+#: ipalib/plugins/baseldap.py:311
 msgid "External host"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:419
+#: ipalib/plugins/baseldap.py:483
 msgid "An IPA master host cannot be deleted or disabled"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:433
+#: ipalib/plugins/baseldap.py:497
 msgid "entry"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:434
+#: ipalib/plugins/baseldap.py:498
 msgid "entries"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:466 ipalib/plugins/baseldap.py:467
+#: ipalib/plugins/baseldap.py:531 ipalib/plugins/baseldap.py:532
 msgid "Entry"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:469
+#: ipalib/plugins/baseldap.py:535
 #, python-format
 msgid "container entry (%(container)s) not found"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:470
+#: ipalib/plugins/baseldap.py:536
 #, python-format
 msgid "%(parent)s: %(oname)s not found"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:471
+#: ipalib/plugins/baseldap.py:537
 #, python-format
 msgid "%(pkey)s: %(oname)s not found"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:472
+#: ipalib/plugins/baseldap.py:538
 #, python-format
 msgid "%(oname)s with name \"%(pkey)s\" already exists"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:669 ipalib/plugins/baseldap.py:677
-#: ipalib/plugins/baseldap.py:682
+#: ipalib/plugins/baseldap.py:738 ipalib/plugins/baseldap.py:746
+#: ipalib/plugins/baseldap.py:751
 #, python-format
 msgid "attribute \"%(attribute)s\" not allowed"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:744
+#: ipalib/plugins/baseldap.py:813
 msgid ""
 "Set an attribute to a name/value pair. Format is attr=value.\n"
 "For multi-valued attributes, the command replaces the values already present."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:750
+#: ipalib/plugins/baseldap.py:819
 msgid ""
 "Add an attribute/value pair. Format is attr=value. The attribute\n"
 "must be part of the schema."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:756
+#: ipalib/plugins/baseldap.py:825
 msgid ""
 "Delete an attribute/value pair. The option will be evaluated\n"
 "last, after all sets and adds."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:784
+#: ipalib/plugins/baseldap.py:859
 msgid "attribute is not configurable"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:887
+#: ipalib/plugins/baseldap.py:962
 msgid "No such attribute on this entry"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:981
+#: ipalib/plugins/baseldap.py:1058
 msgid "Suppress processing of membership attributes."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1159
+#: ipalib/plugins/baseldap.py:1235
 msgid "Continuous mode: Don't stop on errors."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1180 ipalib/plugins/baseldap.py:1253
-#: ipalib/plugins/internal.py:501
+#: ipalib/plugins/baseldap.py:1256 ipalib/plugins/baseldap.py:1332
 msgid "Rights"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1181 ipalib/plugins/baseldap.py:1254
+#: ipalib/plugins/baseldap.py:1257 ipalib/plugins/baseldap.py:1333
 msgid ""
 "Display the access rights of this entry (requires --all). See ipa man page "
 "for details."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1263
+#: ipalib/plugins/baseldap.py:1342
 msgid "Rename"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1264
+#: ipalib/plugins/baseldap.py:1343
 #, python-format
 msgid "Rename the %(ldap_obj_name)s object"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1345
+#: ipalib/plugins/baseldap.py:1424
 msgid "the entry was deleted while being modified"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1472 ipalib/plugins/baseldap.py:1941
+#: ipalib/plugins/baseldap.py:1555 ipalib/plugins/baseldap.py:2023
 #, python-format
 msgid "%s"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1484
+#: ipalib/plugins/baseldap.py:1567
 #, python-format
 msgid "member %s"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1514 ipalib/plugins/baseldap.py:1966
+#: ipalib/plugins/baseldap.py:1597 ipalib/plugins/baseldap.py:2048
 #, python-format
 msgid "%s to add"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1522 ipalib/plugins/baseldap.py:1978
-#: ipalib/plugins/privilege.py:150 ipalib/plugins/privilege.py:175
-#: ipalib/plugins/role.py:164 ipalib/plugins/role.py:187
+#: ipalib/plugins/baseldap.py:1605 ipalib/plugins/baseldap.py:2060
+#: ipalib/plugins/privilege.py:176 ipalib/plugins/privilege.py:231
+#: ipalib/plugins/role.py:211 ipalib/plugins/role.py:234
 msgid "Members that could not be added"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1526 ipalib/plugins/baseldap.py:1982
+#: ipalib/plugins/baseldap.py:1609 ipalib/plugins/baseldap.py:2064
 msgid "Number of members added"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1615 ipalib/plugins/baseldap.py:2071
+#: ipalib/plugins/baseldap.py:1697 ipalib/plugins/baseldap.py:2152
 #, python-format
 msgid "%s to remove"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1622 ipalib/plugins/baseldap.py:2083
+#: ipalib/plugins/baseldap.py:1704 ipalib/plugins/baseldap.py:2164
 msgid "Members that could not be removed"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1626 ipalib/plugins/baseldap.py:2087
+#: ipalib/plugins/baseldap.py:1708 ipalib/plugins/baseldap.py:2168
 msgid "Number of members removed"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1716
+#: ipalib/plugins/baseldap.py:1797
 msgid "Primary key only"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1717
+#: ipalib/plugins/baseldap.py:1798
 #, python-format
 msgid "Results should contain primary key attribute only (\"%s\")"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1725
+#: ipalib/plugins/baseldap.py:1806
 #, python-format
 msgid ""
 "Search for %(searched_object)s with these %(relationship)s %(ldap_object)s."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1726
+#: ipalib/plugins/baseldap.py:1807
 #, python-format
 msgid ""
 "Search for %(searched_object)s without these %(relationship)s "
 "%(ldap_object)s."
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1735
+#: ipalib/plugins/baseldap.py:1816
 msgid "Time Limit"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1736
+#: ipalib/plugins/baseldap.py:1817
 msgid "Time limit of search in seconds"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1742 ipalib/plugins/cert.py:696
-#: ipalib/plugins/hbactest.py:285
+#: ipalib/plugins/baseldap.py:1823 ipalib/plugins/cert.py:721
+#: ipalib/plugins/hbactest.py:289
 msgid "Size Limit"
 msgstr ""
 
-#: ipalib/plugins/baseldap.py:1743
+#: ipalib/plugins/baseldap.py:1824
 msgid "Maximum number of entries returned"
 msgstr ""
 
-#: ipalib/plugins/batch.py:62
+#: ipalib/plugins/batch.py:66
 msgid "Nested Methods to execute"
 msgstr ""
 
-#: ipalib/plugins/cert.py:45
+#: ipalib/plugins/cert.py:47
 msgid ""
 "\n"
 "IPA certificate operations\n"
@@ -1965,260 +2232,275 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/cert.py:145
-msgid "Failure decoding Certificate Signing Request:"
-msgstr ""
-
-#: ipalib/plugins/cert.py:158 ipalib/plugins/cert.py:175
-msgid "Failure decoding Certificate Signing Request"
-msgstr ""
-
-#: ipalib/plugins/cert.py:177
+#: ipalib/plugins/cert.py:155 ipalib/plugins/cert.py:320
 #, python-format
 msgid "Failure decoding Certificate Signing Request: %s"
 msgstr ""
 
-#: ipalib/plugins/cert.py:240
+#: ipalib/plugins/cert.py:219
 msgid "Submit a certificate signing request."
 msgstr ""
 
-#: ipalib/plugins/cert.py:244
+#: ipalib/plugins/cert.py:223
 msgid "CSR"
 msgstr ""
 
-#: ipalib/plugins/cert.py:253 ipalib/plugins/service.py:321
+#: ipalib/plugins/cert.py:232 ipalib/plugins/service.py:371
 msgid "Principal"
 msgstr ""
 
-#: ipalib/plugins/cert.py:254
+#: ipalib/plugins/cert.py:233
 msgid "Service principal for this certificate (e.g. HTTP/test.example.com)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:261
+#: ipalib/plugins/cert.py:240
 msgid "automatically add the principal if it doesn't exist"
 msgstr ""
 
-#: ipalib/plugins/cert.py:269 ipalib/plugins/cert.py:481
-#: ipalib/plugins/host.py:306 ipalib/plugins/internal.py:319
-#: ipalib/plugins/service.py:328
+#: ipalib/plugins/cert.py:248 ipalib/plugins/cert.py:504
+#: ipalib/plugins/host.py:424 ipalib/plugins/internal.py:331
+#: ipalib/plugins/service.py:378
 msgid "Certificate"
 msgstr ""
 
-#: ipalib/plugins/cert.py:272 ipalib/plugins/cert.py:484
-#: ipalib/plugins/cert.py:638 ipalib/plugins/cert.py:639
-#: ipalib/plugins/host.py:166 ipalib/plugins/internal.py:332
-#: ipalib/plugins/service.py:102
+#: ipalib/plugins/cert.py:251 ipalib/plugins/cert.py:507
+#: ipalib/plugins/cert.py:661 ipalib/plugins/cert.py:662
+#: ipalib/plugins/host.py:169 ipalib/plugins/internal.py:344
+#: ipalib/plugins/service.py:105
 msgid "Subject"
 msgstr ""
 
-#: ipalib/plugins/cert.py:275 ipalib/plugins/cert.py:487
-#: ipalib/plugins/host.py:175 ipalib/plugins/service.py:111
+#: ipalib/plugins/cert.py:254 ipalib/plugins/cert.py:510
+#: ipalib/plugins/host.py:178 ipalib/plugins/service.py:114
 msgid "Issuer"
 msgstr ""
 
-#: ipalib/plugins/cert.py:278 ipalib/plugins/cert.py:490
-#: ipalib/plugins/host.py:178 ipalib/plugins/service.py:114
+#: ipalib/plugins/cert.py:257 ipalib/plugins/cert.py:513
+#: ipalib/plugins/host.py:181 ipalib/plugins/service.py:117
 msgid "Not Before"
 msgstr ""
 
-#: ipalib/plugins/cert.py:281 ipalib/plugins/cert.py:493
-#: ipalib/plugins/host.py:181 ipalib/plugins/service.py:117
+#: ipalib/plugins/cert.py:260 ipalib/plugins/cert.py:516
+#: ipalib/plugins/host.py:184 ipalib/plugins/service.py:120
 msgid "Not After"
 msgstr ""
 
-#: ipalib/plugins/cert.py:284 ipalib/plugins/cert.py:496
-#: ipalib/plugins/host.py:184 ipalib/plugins/service.py:120
+#: ipalib/plugins/cert.py:263 ipalib/plugins/cert.py:519
+#: ipalib/plugins/host.py:187 ipalib/plugins/service.py:123
 msgid "Fingerprint (MD5)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:287 ipalib/plugins/cert.py:499
-#: ipalib/plugins/host.py:187 ipalib/plugins/service.py:123
+#: ipalib/plugins/cert.py:266 ipalib/plugins/cert.py:522
+#: ipalib/plugins/host.py:190 ipalib/plugins/service.py:126
 msgid "Fingerprint (SHA1)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:290 ipalib/plugins/cert.py:469
-#: ipalib/plugins/cert.py:710
+#: ipalib/plugins/cert.py:269 ipalib/plugins/cert.py:491
+#: ipalib/plugins/cert.py:735
 msgid "Serial number"
 msgstr ""
 
-#: ipalib/plugins/cert.py:293 ipalib/plugins/cert.py:505
-#: ipalib/plugins/cert.py:707
+#: ipalib/plugins/cert.py:272 ipalib/plugins/cert.py:528
+#: ipalib/plugins/cert.py:732
 msgid "Serial number (hex)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:300 ipalib/plugins/misc.py:57
+#: ipalib/plugins/cert.py:279 ipalib/plugins/misc.py:61
 msgid "Dictionary mapping variable name to value"
 msgstr ""
 
-#: ipalib/plugins/cert.py:333
+#: ipalib/plugins/cert.py:332
 msgid "No hostname was found in subject of request."
 msgstr ""
 
-#: ipalib/plugins/cert.py:338
+#: ipalib/plugins/cert.py:337
 #, python-format
 msgid ""
 "hostname in subject of request '%(subject_host)s' does not match principal "
 "hostname '%(hostname)s'"
 msgstr ""
 
-#: ipalib/plugins/cert.py:356
+#: ipalib/plugins/cert.py:344
+#, python-format
+msgid "extension %s is forbidden"
+msgstr ""
+
+#: ipalib/plugins/cert.py:352
+#, python-format
+msgid "subject alt name type %s is forbidden"
+msgstr ""
+
+#: ipalib/plugins/cert.py:366
 msgid "The service principal for this request doesn't exist."
 msgstr ""
 
-#: ipalib/plugins/cert.py:362
+#: ipalib/plugins/cert.py:371
 msgid "You need to be a member of the serviceadmin role to add services"
 msgstr ""
 
-#: ipalib/plugins/cert.py:367
+#: ipalib/plugins/cert.py:378
 #, python-format
 msgid ""
 "Insufficient 'write' privilege to the 'userCertificate' attribute of entry "
 "'%s'."
 msgstr ""
 
-#: ipalib/plugins/cert.py:383
+#: ipalib/plugins/cert.py:396
 #, python-format
-msgid "no host record for subject alt name %s in certificate request"
+msgid ""
+"The service principal for subject alt name %s in certificate request does "
+"not exist"
 msgstr ""
 
-#: ipalib/plugins/cert.py:389
+#: ipalib/plugins/cert.py:402
 #, python-format
 msgid ""
 "Insufficient privilege to create a certificate with subject alt name '%s'."
 msgstr ""
 
-#: ipalib/plugins/cert.py:442
+#: ipalib/plugins/cert.py:408
+#, python-format
+msgid ""
+"Principal '%s' in subject alt name does not match requested service principal"
+msgstr ""
+
+#: ipalib/plugins/cert.py:412
+#, python-format
+msgid "Subject alt name type %s is forbidden"
+msgstr ""
+
+#: ipalib/plugins/cert.py:465
 msgid "Check the status of a certificate signing request."
 msgstr ""
 
-#: ipalib/plugins/cert.py:446
+#: ipalib/plugins/cert.py:469
 msgid "Request id"
 msgstr ""
 
-#: ipalib/plugins/cert.py:452
+#: ipalib/plugins/cert.py:475
 msgid "Request status"
 msgstr ""
 
-#: ipalib/plugins/cert.py:470
+#: ipalib/plugins/cert.py:492
 msgid "Serial number in decimal or if prefixed with 0x in hexadecimal"
 msgstr ""
 
-#: ipalib/plugins/cert.py:475
+#: ipalib/plugins/cert.py:498
 msgid "Retrieve an existing certificate."
 msgstr ""
 
-#: ipalib/plugins/cert.py:502 ipalib/plugins/host.py:190
-#: ipalib/plugins/internal.py:329 ipalib/plugins/internal.py:358
-#: ipalib/plugins/service.py:126
+#: ipalib/plugins/cert.py:525 ipalib/plugins/host.py:193
+#: ipalib/plugins/internal.py:341 ipalib/plugins/internal.py:371
+#: ipalib/plugins/service.py:129
 msgid "Revocation reason"
 msgstr ""
 
-#: ipalib/plugins/cert.py:511
+#: ipalib/plugins/cert.py:534
 msgid "Output filename"
 msgstr ""
 
-#: ipalib/plugins/cert.py:512
+#: ipalib/plugins/cert.py:535
 msgid "File to store the certificate in."
 msgstr ""
 
-#: ipalib/plugins/cert.py:563
+#: ipalib/plugins/cert.py:586
 msgid "Revoke a certificate."
 msgstr ""
 
-#: ipalib/plugins/cert.py:569
+#: ipalib/plugins/cert.py:592
 msgid "Revoked"
 msgstr ""
 
-#: ipalib/plugins/cert.py:577 ipalib/plugins/cert.py:643
+#: ipalib/plugins/cert.py:600 ipalib/plugins/cert.py:666
 msgid "Reason"
 msgstr ""
 
-#: ipalib/plugins/cert.py:578 ipalib/plugins/cert.py:644
+#: ipalib/plugins/cert.py:601 ipalib/plugins/cert.py:667
 msgid "Reason for revoking the certificate (0-10)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:600
+#: ipalib/plugins/cert.py:623
 msgid "7 is not a valid revocation reason"
 msgstr ""
 
-#: ipalib/plugins/cert.py:610
+#: ipalib/plugins/cert.py:633
 msgid "Take a revoked certificate off hold."
 msgstr ""
 
-#: ipalib/plugins/cert.py:616
+#: ipalib/plugins/cert.py:639
 msgid "Unrevoked"
 msgstr ""
 
-#: ipalib/plugins/cert.py:619 ipalib/plugins/internal.py:249
+#: ipalib/plugins/cert.py:642 ipalib/plugins/internal.py:261
 msgid "Error"
 msgstr ""
 
-#: ipalib/plugins/cert.py:634
+#: ipalib/plugins/cert.py:657
 msgid "Search for existing certificates."
 msgstr ""
 
-#: ipalib/plugins/cert.py:650
+#: ipalib/plugins/cert.py:673
 msgid "minimum serial number"
 msgstr ""
 
-#: ipalib/plugins/cert.py:655
+#: ipalib/plugins/cert.py:679
 msgid "maximum serial number"
 msgstr ""
 
-#: ipalib/plugins/cert.py:660
+#: ipalib/plugins/cert.py:685
 msgid "match the common name exactly"
 msgstr ""
 
-#: ipalib/plugins/cert.py:664
+#: ipalib/plugins/cert.py:689
 msgid "Valid not after from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:668
+#: ipalib/plugins/cert.py:693
 msgid "Valid not after to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:672
+#: ipalib/plugins/cert.py:697
 msgid "Valid not before from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:676
+#: ipalib/plugins/cert.py:701
 msgid "Valid not before to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:680
+#: ipalib/plugins/cert.py:705
 msgid "Issued on from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:684
+#: ipalib/plugins/cert.py:709
 msgid "Issued on to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:688
+#: ipalib/plugins/cert.py:713
 msgid "Revoked on from this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:692
+#: ipalib/plugins/cert.py:717
 msgid "Revoked on to this date (YYYY-mm-dd)"
 msgstr ""
 
-#: ipalib/plugins/cert.py:697
+#: ipalib/plugins/cert.py:722
 msgid "Maximum number of certs returned"
 msgstr ""
 
-#: ipalib/plugins/cert.py:713 ipalib/plugins/internal.py:366
-#: ipalib/plugins/internal.py:472 ipalib/plugins/internal.py:552
-#: ipalib/plugins/internal.py:659
+#: ipalib/plugins/cert.py:738 ipalib/plugins/internal.py:379
+#: ipalib/plugins/internal.py:488 ipalib/plugins/internal.py:575
+#: ipalib/plugins/internal.py:687
 msgid "Status"
 msgstr ""
 
-#: ipalib/plugins/cert.py:718
+#: ipalib/plugins/cert.py:743
 #, python-format
 msgid "%(count)d certificate matched"
 msgid_plural "%(count)d certificates matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/config.py:32
+#: ipalib/plugins/config.py:33
 msgid ""
 "\n"
 "Server configuration\n"
@@ -2268,187 +2550,195 @@ msgid ""
 "s0:c0.c1023$staff_u:s0-s0:c0.c1023$unconfined_u:s0-s0:c0.c1023'\n"
 msgstr ""
 
-#: ipalib/plugins/config.py:80
+#: ipalib/plugins/config.py:83
 msgid "searchtimelimit must be -1 or > 1."
 msgstr ""
 
-#: ipalib/plugins/config.py:87
+#: ipalib/plugins/config.py:91
 msgid "configuration options"
 msgstr ""
 
-#: ipalib/plugins/config.py:97 ipalib/plugins/config.py:98
+#: ipalib/plugins/config.py:124 ipalib/plugins/config.py:125
 msgid "Configuration"
 msgstr ""
 
-#: ipalib/plugins/config.py:103
+#: ipalib/plugins/config.py:130
 msgid "Maximum username length"
 msgstr ""
 
-#: ipalib/plugins/config.py:108
+#: ipalib/plugins/config.py:135
 msgid "Home directory base"
 msgstr ""
 
-#: ipalib/plugins/config.py:109
+#: ipalib/plugins/config.py:136
 msgid "Default location of home directories"
 msgstr ""
 
-#: ipalib/plugins/config.py:113
+#: ipalib/plugins/config.py:140
 msgid "Default shell"
 msgstr ""
 
-#: ipalib/plugins/config.py:114
+#: ipalib/plugins/config.py:141
 msgid "Default shell for new users"
 msgstr ""
 
-#: ipalib/plugins/config.py:118
+#: ipalib/plugins/config.py:145
 msgid "Default users group"
 msgstr ""
 
-#: ipalib/plugins/config.py:119
+#: ipalib/plugins/config.py:146
 msgid "Default group for new users"
 msgstr ""
 
-#: ipalib/plugins/config.py:123 ipalib/plugins/config.py:124
+#: ipalib/plugins/config.py:150 ipalib/plugins/config.py:151
 msgid "Default e-mail domain"
 msgstr ""
 
-#: ipalib/plugins/config.py:128
+#: ipalib/plugins/config.py:155
 msgid "Search time limit"
 msgstr ""
 
-#: ipalib/plugins/config.py:129
+#: ipalib/plugins/config.py:156
 msgid ""
 "Maximum amount of time (seconds) for a search (> 0, or -1 for unlimited)"
 msgstr ""
 
-#: ipalib/plugins/config.py:134
+#: ipalib/plugins/config.py:161
 msgid "Search size limit"
 msgstr ""
 
-#: ipalib/plugins/config.py:135
+#: ipalib/plugins/config.py:162
 msgid "Maximum number of records to search (-1 is unlimited)"
 msgstr ""
 
-#: ipalib/plugins/config.py:140
+#: ipalib/plugins/config.py:167
 msgid "User search fields"
 msgstr ""
 
-#: ipalib/plugins/config.py:141
+#: ipalib/plugins/config.py:168
 msgid "A comma-separated list of fields to search in when searching for users"
 msgstr ""
 
-#: ipalib/plugins/config.py:146
+#: ipalib/plugins/config.py:173
 msgid "A comma-separated list of fields to search in when searching for groups"
 msgstr ""
 
-#: ipalib/plugins/config.py:150 ipalib/plugins/config.py:151
+#: ipalib/plugins/config.py:177 ipalib/plugins/config.py:178
 msgid "Enable migration mode"
 msgstr ""
 
-#: ipalib/plugins/config.py:155
+#: ipalib/plugins/config.py:182
 msgid "Certificate Subject base"
 msgstr ""
 
-#: ipalib/plugins/config.py:156
+#: ipalib/plugins/config.py:183
 msgid "Base for certificate subjects (OU=Test,O=Example)"
 msgstr ""
 
-#: ipalib/plugins/config.py:161
+#: ipalib/plugins/config.py:188
 msgid "Default group objectclasses"
 msgstr ""
 
-#: ipalib/plugins/config.py:162
+#: ipalib/plugins/config.py:189
 msgid "Default group objectclasses (comma-separated list)"
 msgstr ""
 
-#: ipalib/plugins/config.py:167
+#: ipalib/plugins/config.py:194
 msgid "Default user objectclasses"
 msgstr ""
 
-#: ipalib/plugins/config.py:168
+#: ipalib/plugins/config.py:195
 msgid "Default user objectclasses (comma-separated list)"
 msgstr ""
 
-#: ipalib/plugins/config.py:173
+#: ipalib/plugins/config.py:200
 msgid "Password Expiration Notification (days)"
 msgstr ""
 
-#: ipalib/plugins/config.py:174
+#: ipalib/plugins/config.py:201
 msgid "Number of days's notice of impending password expiration"
 msgstr ""
 
-#: ipalib/plugins/config.py:179
+#: ipalib/plugins/config.py:206
 msgid "Password plugin features"
 msgstr ""
 
-#: ipalib/plugins/config.py:180
+#: ipalib/plugins/config.py:207
 msgid "Extra hashes to generate in password plug-in"
 msgstr ""
 
-#: ipalib/plugins/config.py:186
+#: ipalib/plugins/config.py:213
 msgid "SELinux user map order"
 msgstr ""
 
-#: ipalib/plugins/config.py:187
+#: ipalib/plugins/config.py:214
 msgid "Order in increasing priority of SELinux users, delimited by $"
 msgstr ""
 
-#: ipalib/plugins/config.py:190
+#: ipalib/plugins/config.py:217
 msgid "Default SELinux user"
 msgstr ""
 
-#: ipalib/plugins/config.py:191
+#: ipalib/plugins/config.py:218
 msgid "Default SELinux user when no match is found in SELinux map rule"
 msgstr ""
 
-#: ipalib/plugins/config.py:195
+#: ipalib/plugins/config.py:222
 msgid "Default PAC types"
 msgstr ""
 
-#: ipalib/plugins/config.py:196
+#: ipalib/plugins/config.py:223
 msgid "Default types of PAC supported for services"
 msgstr ""
 
-#: ipalib/plugins/config.py:209
+#: ipalib/plugins/config.py:229
+msgid "Default user authentication types"
+msgstr ""
+
+#: ipalib/plugins/config.py:230
+msgid "Default types of supported user authentication"
+msgstr ""
+
+#: ipalib/plugins/config.py:243
 msgid "Modify configuration options."
 msgstr ""
 
-#: ipalib/plugins/config.py:218
+#: ipalib/plugins/config.py:252
 msgid "The group doesn't exist"
 msgstr ""
 
-#: ipalib/plugins/config.py:233
+#: ipalib/plugins/config.py:267
 #, python-format
 msgid "attribute \"%s\" not allowed"
 msgstr ""
 
-#: ipalib/plugins/config.py:241
+#: ipalib/plugins/config.py:275
 msgid "May not be empty"
 msgstr ""
 
-#: ipalib/plugins/config.py:259
+#: ipalib/plugins/config.py:293
 #, python-format
 msgid "%(obj)s default attribute %(attr)s would not be allowed!"
 msgstr ""
 
-#: ipalib/plugins/config.py:291
+#: ipalib/plugins/config.py:325
 msgid "A list of SELinux users delimited by $ expected"
 msgstr ""
 
-#: ipalib/plugins/config.py:295
+#: ipalib/plugins/config.py:329
 #, python-format
 msgid "SELinux user '%(user)s' is not valid: %(error)s"
 msgstr ""
 
-#: ipalib/plugins/config.py:307
+#: ipalib/plugins/config.py:341
 msgid "SELinux user map default user not in order list"
 msgstr ""
 
-#: ipalib/plugins/config.py:315
+#: ipalib/plugins/config.py:349
 msgid "Show the current configuration."
 msgstr ""
 
-#: ipalib/plugins/delegation.py:29
+#: ipalib/plugins/delegation.py:30
 msgid ""
 "\n"
 "Group to Group Delegation\n"
@@ -2478,85 +2768,85 @@ msgid ""
 "   ipa delegation-del \"managers edit employees' street\"\n"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:69
+#: ipalib/plugins/delegation.py:73
 msgid "delegation"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:70
+#: ipalib/plugins/delegation.py:74
 msgid "delegations"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:71
+#: ipalib/plugins/delegation.py:75
 msgid "Delegations"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:72
+#: ipalib/plugins/delegation.py:76
 msgid "Delegation"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:77 ipalib/plugins/delegation.py:78
+#: ipalib/plugins/delegation.py:81 ipalib/plugins/delegation.py:82
 msgid "Delegation name"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:84 ipalib/plugins/selfservice.py:88
+#: ipalib/plugins/delegation.py:88 ipalib/plugins/selfservice.py:92
 msgid "Permissions to grant (read, write). Default is write."
 msgstr ""
 
-#: ipalib/plugins/delegation.py:90
+#: ipalib/plugins/delegation.py:94
 msgid "Attributes to which the delegation applies"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:96
+#: ipalib/plugins/delegation.py:100
 msgid "Member user group"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:97
+#: ipalib/plugins/delegation.py:101
 msgid "User group to apply delegation to"
 msgstr ""
 
-#: ipalib/plugins/delegation.py:130
+#: ipalib/plugins/delegation.py:134
 msgid "Add a new delegation."
 msgstr ""
 
-#: ipalib/plugins/delegation.py:132
+#: ipalib/plugins/delegation.py:136
 #, python-format
 msgid "Added delegation \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/delegation.py:151
+#: ipalib/plugins/delegation.py:155
 msgid "Delete a delegation."
 msgstr ""
 
-#: ipalib/plugins/delegation.py:154
+#: ipalib/plugins/delegation.py:158
 #, python-format
 msgid "Deleted delegation \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/delegation.py:169
+#: ipalib/plugins/delegation.py:173
 msgid "Modify a delegation."
 msgstr ""
 
-#: ipalib/plugins/delegation.py:171
+#: ipalib/plugins/delegation.py:175
 #, python-format
 msgid "Modified delegation \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/delegation.py:188
+#: ipalib/plugins/delegation.py:192
 msgid "Search for delegations."
 msgstr ""
 
-#: ipalib/plugins/delegation.py:191
+#: ipalib/plugins/delegation.py:195
 #, python-format
 msgid "%(count)d delegation matched"
 msgid_plural "%(count)d delegations matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/delegation.py:214
+#: ipalib/plugins/delegation.py:218
 msgid "Display information about a delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:41
+#: ipalib/plugins/dns.py:46
 msgid ""
 "\n"
 "Domain Name System (DNS)\n"
@@ -2767,243 +3057,233 @@ msgid ""
 "   ipa dnsconfig-mod --forwarder=10.0.0.1\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:293
+#: ipalib/plugins/dns.py:267
+msgid "Permission value"
+msgstr ""
+
+#: ipalib/plugins/dns.py:312
 #, python-format
 msgid "invalid IP address version (is %(value)d, must be %(required_value)d)!"
 msgstr ""
 
-#: ipalib/plugins/dns.py:296
+#: ipalib/plugins/dns.py:315
 msgid "invalid IP address format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:309
+#: ipalib/plugins/dns.py:328
 msgid "invalid IP network format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:318
+#: ipalib/plugins/dns.py:337
 msgid "each ACL element must be terminated with a semicolon"
 msgstr ""
 
-#: ipalib/plugins/dns.py:335
+#: ipalib/plugins/dns.py:354
 msgid "invalid address format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:379 ipalib/plugins/dns.py:422
+#: ipalib/plugins/dns.py:404
 #, python-format
-msgid "invalid domain-name: %s"
+msgid "%(port)s is not a valid port"
 msgstr ""
 
-#: ipalib/plugins/dns.py:408
-#, python-format
-msgid "%(port)s is not a valid port"
+#: ipalib/plugins/dns.py:411
+msgid "invalid domain-name: not fully qualified"
 msgstr ""
 
-#: ipalib/plugins/dns.py:484
+#: ipalib/plugins/dns.py:466
 #, python-format
 msgid "DNS reverse zone for IP address %(addr)s not found"
 msgstr ""
 
-#: ipalib/plugins/dns.py:496
+#: ipalib/plugins/dns.py:481
 #, python-format
 msgid "DNS zone %(zone)s not found"
 msgstr ""
 
-#: ipalib/plugins/dns.py:510
+#: ipalib/plugins/dns.py:495
 #, python-format
 msgid "IP address %(ip)s is already assigned in domain %(domain)s."
 msgstr ""
 
-#: ipalib/plugins/dns.py:523
+#: ipalib/plugins/dns.py:508
 #, python-format
 msgid ""
 "Reverse record for IP address %(ip)s already exists in reverse zone %(zone)s."
 msgstr ""
 
-#: ipalib/plugins/dns.py:559
+#: ipalib/plugins/dns.py:585
 #, python-format
 msgid "%s record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:561
+#: ipalib/plugins/dns.py:587
 #, python-format
 msgid "Raw %s records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:562
+#: ipalib/plugins/dns.py:588
 #, python-format
 msgid "%s Record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:563
+#: ipalib/plugins/dns.py:589
 #, python-format
 msgid "(see RFC %s for details)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:619
+#: ipalib/plugins/dns.py:654
 #, python-format
 msgid "'%s' is a required part of DNS record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:626
+#: ipalib/plugins/dns.py:661
 msgid "Invalid number of parts!"
 msgstr ""
 
-#: ipalib/plugins/dns.py:681
+#: ipalib/plugins/dns.py:716
 #, python-format
 msgid "DNS RR type \"%s\" is not supported by bind-dyndb-ldap plugin"
 msgstr ""
 
-#: ipalib/plugins/dns.py:697
+#: ipalib/plugins/dns.py:732
 #, python-format
 msgid "format must be specified as \"%(format)s\" %(rfcs)s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:821
+#: ipalib/plugins/dns.py:856
 msgid "Create reverse"
 msgstr ""
 
-#: ipalib/plugins/dns.py:822
+#: ipalib/plugins/dns.py:857
 msgid "Create reverse record for this IP Address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:857
+#: ipalib/plugins/dns.py:892
 #, python-format
 msgid "Cannot create reverse record for \"%(value)s\": %(exc)s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:866 ipalib/plugins/dns.py:889
-#: ipalib/plugins/host.py:406
+#: ipalib/plugins/dns.py:901 ipalib/plugins/dns.py:924
+#: ipalib/plugins/host.py:525
 msgid "IP Address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:875 ipalib/plugins/dns.py:1486
+#: ipalib/plugins/dns.py:910 ipalib/plugins/dns.py:1453
 msgid "Record data"
 msgstr ""
 
-#: ipalib/plugins/dns.py:898
+#: ipalib/plugins/dns.py:933
 msgid "Subtype"
 msgstr ""
 
-#: ipalib/plugins/dns.py:904 ipalib/plugins/dns.py:943
-#: ipalib/plugins/dns.py:1196 ipalib/plugins/dns.py:1293
-#: ipalib/plugins/dns.py:2930
+#: ipalib/plugins/dns.py:938 ipalib/plugins/dns.py:976
+#: ipalib/plugins/dns.py:1215 ipalib/plugins/dns.py:1306
+#: ipalib/plugins/dns.py:3564
 msgid "Hostname"
 msgstr ""
 
-#: ipalib/plugins/dns.py:918
+#: ipalib/plugins/dns.py:952
 msgid "Certificate Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:923 ipalib/plugins/dns.py:978
-#: ipalib/plugins/dns.py:1376
+#: ipalib/plugins/dns.py:957 ipalib/plugins/dns.py:1005
 msgid "Key Tag"
 msgstr ""
 
-#: ipalib/plugins/dns.py:928 ipalib/plugins/dns.py:983
-#: ipalib/plugins/dns.py:1017 ipalib/plugins/dns.py:1354
-#: ipalib/plugins/dns.py:1402
+#: ipalib/plugins/dns.py:962 ipalib/plugins/dns.py:1010
+#: ipalib/plugins/dns.py:1234 ipalib/plugins/dns.py:1369
+#: ipalib/plugins/otptoken.py:198
 msgid "Algorithm"
 msgstr ""
 
-#: ipalib/plugins/dns.py:933
+#: ipalib/plugins/dns.py:967
 msgid "Certificate/CRL"
 msgstr ""
 
-#: ipalib/plugins/dns.py:944
+#: ipalib/plugins/dns.py:977
 msgid "A hostname which this alias hostname points to"
 msgstr ""
 
-#: ipalib/plugins/dns.py:964 ipalib/plugins/dns.py:1330
-#: ipalib/plugins/internal.py:502
+#: ipalib/plugins/dns.py:991 ipalib/plugins/dns.py:1336
+#: ipalib/plugins/internal.py:522
 msgid "Target"
 msgstr ""
 
-#: ipalib/plugins/dns.py:988
+#: ipalib/plugins/dns.py:1015
 msgid "Digest Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:993
+#: ipalib/plugins/dns.py:1020
 msgid "Digest"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1007 ipalib/plugins/dns.py:1272
-msgid "Flags"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1012
-msgid "Protocol"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1022
-msgid "Public Key"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1036 ipalib/plugins/dns.py:1177
-#: ipalib/plugins/dns.py:1266
+#: ipalib/plugins/dns.py:1053 ipalib/plugins/dns.py:1198
+#: ipalib/plugins/dns.py:1280
 msgid "Preference"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1037 ipalib/plugins/dns.py:1178
+#: ipalib/plugins/dns.py:1054 ipalib/plugins/dns.py:1199
 msgid "Preference given to this exchanger. Lower values are more preferred"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1043 ipalib/plugins/dns.py:1184
+#: ipalib/plugins/dns.py:1059 ipalib/plugins/dns.py:1204
 msgid "Exchanger"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1044
+#: ipalib/plugins/dns.py:1060
 msgid "A host willing to act as a key exchanger"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1053
+#: ipalib/plugins/dns.py:1069
 msgid "Degrees Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1058
+#: ipalib/plugins/dns.py:1074
 msgid "Minutes Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1063
+#: ipalib/plugins/dns.py:1079
 msgid "Seconds Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1069
+#: ipalib/plugins/dns.py:1085
 msgid "Direction Latitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1073
+#: ipalib/plugins/dns.py:1089
 msgid "Degrees Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1078
+#: ipalib/plugins/dns.py:1094
 msgid "Minutes Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1083
+#: ipalib/plugins/dns.py:1099
 msgid "Seconds Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1089
+#: ipalib/plugins/dns.py:1105
 msgid "Direction Longitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1093
+#: ipalib/plugins/dns.py:1109
 msgid "Altitude"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1099
+#: ipalib/plugins/dns.py:1115
 msgid "Size"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1105
+#: ipalib/plugins/dns.py:1121
 msgid "Horizontal Precision"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1111
+#: ipalib/plugins/dns.py:1127
 msgid "Vertical Precision"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1118
+#: ipalib/plugins/dns.py:1134
 msgid ""
 "format must be specified as\n"
 "    \"d1 [m1 [s1]] {\"N\"|\"S\"}  d2 [m2 [s2]] {\"E\"|\"W\"} alt[\"m\"] "
@@ -3018,547 +3298,556 @@ msgid ""
 "    See RFC 1876 for details"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1167
+#: ipalib/plugins/dns.py:1188
 #, python-format
 msgid "'%(required)s' must not be empty when '%(name)s' is set"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1185
+#: ipalib/plugins/dns.py:1205
 msgid "A host willing to act as a mail exchanger"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1203
-msgid ""
-"format must be specified as \"NEXT TYPE1 [TYPE2 [TYPE3 [...]]]\" (see RFC "
-"4034 for details)"
+#: ipalib/plugins/dns.py:1239 ipalib/plugins/dns.py:1286
+msgid "Flags"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1210
-msgid "Next Domain Name"
+#: ipalib/plugins/dns.py:1245
+msgid "Iterations"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1213
-msgid "Type Map"
+#: ipalib/plugins/dns.py:1250
+msgid "Salt"
+msgstr ""
+
+#: ipalib/plugins/dns.py:1251
+msgid ""
+"A hexadecimal salt value. Requires hexadecimal digits or hyphen (\"-\") if "
+"no salt is required"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1253
+#: ipalib/plugins/dns.py:1267
 msgid "flags must be one of \"S\", \"A\", \"U\", or \"P\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:1261
+#: ipalib/plugins/dns.py:1275
 msgid "Order"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1276 ipalib/plugins/hbactest.py:265
-#: ipalib/plugins/internal.py:551 ipalib/plugins/service.py:316
+#: ipalib/plugins/dns.py:1290 ipalib/plugins/hbactest.py:269
+#: ipalib/plugins/internal.py:574 ipalib/plugins/service.py:366
 msgid "Service"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1279
+#: ipalib/plugins/dns.py:1293
 msgid "Regular Expression"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1282
+#: ipalib/plugins/dns.py:1296
 msgid "Replacement"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1294
+#: ipalib/plugins/dns.py:1307
 msgid "The hostname this reverse record points to"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1314 ipalib/plugins/pwpolicy.py:267
+#: ipalib/plugins/dns.py:1321 ipalib/plugins/pwpolicy.py:346
 msgid "Priority"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1319
+#: ipalib/plugins/dns.py:1326
 msgid "Weight"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1324
+#: ipalib/plugins/dns.py:1331
 msgid "Port"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1331
+#: ipalib/plugins/dns.py:1337
 msgid ""
 "The domain name of the target host or '.' if the service is decidedly not "
 "available at this domain"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1340
+#: ipalib/plugins/dns.py:1346
 msgid "the value does not follow \"YYYYMMDDHHMMSS\" time format"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1350
-msgid "Type Covered"
+#: ipalib/plugins/dns.py:1374
+msgid "Fingerprint Type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1359
-msgid "Labels"
+#: ipalib/plugins/dns.py:1379
+msgid "Fingerprint"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1364
-msgid "Original TTL"
+#: ipalib/plugins/dns.py:1400
+msgid "Text Data"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1369
-msgid "Signature Expiration"
+#: ipalib/plugins/dns.py:1447
+msgid "Records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1373
-msgid "Signature Inception"
+#: ipalib/plugins/dns.py:1450
+msgid "Record type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1381
-msgid "Signer's Name"
+#: ipalib/plugins/dns.py:1485
+#, python-format
+msgid "Nameserver '%(host)s' does not have a corresponding A/AAAA record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1384
-msgid "Signature"
+#: ipalib/plugins/dns.py:1504
+msgid "Managedby permission"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1407
-msgid "Fingerprint Type"
+#: ipalib/plugins/dns.py:1650
+msgid "Zone name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1412
-msgid "Fingerprint"
+#: ipalib/plugins/dns.py:1651
+msgid "Zone name (FQDN)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1433
-msgid "Text Data"
+#: ipalib/plugins/dns.py:1656
+msgid "Reverse zone IP network"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1480
-msgid "Records"
+#: ipalib/plugins/dns.py:1657
+msgid "IP network to create reverse zone name from"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1483
-msgid "Record type"
+#: ipalib/plugins/dns.py:1662
+msgid "Active zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1516
-#, python-format
-msgid "Nameserver '%(host)s' does not have a corresponding A/AAAA record"
+#: ipalib/plugins/dns.py:1663
+msgid "Is zone active?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1534
-msgid "Managedby permission"
+#: ipalib/plugins/dns.py:1670
+msgid "Zone forwarders"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1543
-msgid "DNS zone"
+#: ipalib/plugins/dns.py:1671
+msgid ""
+"Per-zone forwarders. A custom port can be specified for each forwarder using "
+"a standard format \"IP_ADDRESS port PORT\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:1544
-msgid "DNS zones"
+#: ipalib/plugins/dns.py:1677 ipalib/plugins/dns.py:3633
+msgid "Forward policy"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1553
-msgid "DNS Zones"
+#: ipalib/plugins/dns.py:1678
+msgid ""
+"Per-zone conditional forwarding policy. Set to \"none\" to disable "
+"forwarding to global forwarder for this zone. In that case, conditional zone "
+"forwarders are disregarded."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1554
-msgid "DNS Zone"
+#: ipalib/plugins/dns.py:1735
+msgid "DNS is not configured"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1560
-msgid "Zone name"
+#: ipalib/plugins/dns.py:1746
+msgid "Only one zone type is allowed per zone name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1561
-msgid "Zone name (FQDN)"
+#: ipalib/plugins/dns.py:1777 ipalib/plugins/dns.py:2351
+msgid "Search for DNS zones (SOA records)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1567
-msgid "Reverse zone IP network"
+#: ipalib/plugins/dns.py:1864
+#, python-format
+msgid "Added system permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:1568
-msgid "IP network to create reverse zone name from"
+#: ipalib/plugins/dns.py:1891
+#, python-format
+msgid "permission \"%(value)s\" already exists"
+msgstr ""
+
+#: ipalib/plugins/dns.py:1919
+#, python-format
+msgid "Removed system permission \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/dns.py:1967
+msgid "DNS zone"
+msgstr ""
+
+#: ipalib/plugins/dns.py:1968
+msgid "DNS zones"
+msgstr ""
+
+#: ipalib/plugins/dns.py:1975
+msgid "DNS Zones"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1573
+#: ipalib/plugins/dns.py:1976
+msgid "DNS Zone"
+msgstr ""
+
+#: ipalib/plugins/dns.py:1981
 msgid "Authoritative nameserver"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1574
+#: ipalib/plugins/dns.py:1982
 msgid "Authoritative nameserver domain name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1580 ipalib/plugins/dns.py:1581
+#: ipalib/plugins/dns.py:1988 ipalib/plugins/dns.py:1989
 msgid "Administrator e-mail address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1587
+#: ipalib/plugins/dns.py:1996
 msgid "SOA serial"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1588
+#: ipalib/plugins/dns.py:1997
 msgid "SOA record serial number"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1596
+#: ipalib/plugins/dns.py:2005
 msgid "SOA refresh"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1597
+#: ipalib/plugins/dns.py:2006
 msgid "SOA record refresh time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1605
+#: ipalib/plugins/dns.py:2014
 msgid "SOA retry"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1606
+#: ipalib/plugins/dns.py:2015
 msgid "SOA record retry time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1614
+#: ipalib/plugins/dns.py:2023
 msgid "SOA expire"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1615
+#: ipalib/plugins/dns.py:2024
 msgid "SOA record expire time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1623
+#: ipalib/plugins/dns.py:2032
 msgid "SOA minimum"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1624
+#: ipalib/plugins/dns.py:2033
 msgid "How long should negative responses be cached"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1632
-msgid "SOA time to live"
+#: ipalib/plugins/dns.py:2041 ipalib/plugins/dns.py:2446
+#: ipalib/plugins/dns.py:2447
+msgid "Time to live"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1633
-msgid "SOA record time to live"
+#: ipalib/plugins/dns.py:2042
+msgid "Time to live for records at zone apex"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1639
+#: ipalib/plugins/dns.py:2048
 msgid "SOA class"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1640
+#: ipalib/plugins/dns.py:2049
 msgid "SOA record class"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1645 ipalib/plugins/dns.py:1646
+#: ipalib/plugins/dns.py:2054 ipalib/plugins/dns.py:2055
 msgid "BIND update policy"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1652
-msgid "Active zone"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1653
-msgid "Is zone active?"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1659
+#: ipalib/plugins/dns.py:2061
 msgid "Dynamic update"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1660
+#: ipalib/plugins/dns.py:2062
 msgid "Allow dynamic updates."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1669
+#: ipalib/plugins/dns.py:2071
 msgid "Allow query"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1670
+#: ipalib/plugins/dns.py:2072
 msgid ""
 "Semicolon separated list of IP addresses or networks which are allowed to "
 "issue queries"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1678
+#: ipalib/plugins/dns.py:2080
 msgid "Allow transfer"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1679
+#: ipalib/plugins/dns.py:2081
 msgid ""
 "Semicolon separated list of IP addresses or networks which are allowed to "
 "transfer the zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1686
-msgid "Zone forwarders"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1687
-msgid ""
-"Per-zone forwarders. A custom port can be specified for each forwarder using "
-"a standard format \"IP_ADDRESS port PORT\""
-msgstr ""
-
-#: ipalib/plugins/dns.py:1693 ipalib/plugins/dns.py:2999
-msgid "Forward policy"
+#: ipalib/plugins/dns.py:2087 ipalib/plugins/dns.py:3640
+msgid "Allow PTR sync"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1694
+#: ipalib/plugins/dns.py:2088
 msgid ""
-"Per-zone conditional forwarding policy. Set to \"none\" to disable "
-"forwarding to global forwarder for this zone. In that case, conditional zone "
-"forwarders are disregarded."
+"Allow synchronization of forward (A, AAAA) and reverse (PTR) records in the "
+"zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1701 ipalib/plugins/dns.py:3006
-msgid "Allow PTR sync"
+#: ipalib/plugins/dns.py:2093
+msgid "Allow in-line DNSSEC signing"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1702
-msgid ""
-"Allow synchronization of forward (A, AAAA) and reverse (PTR) records in the "
-"zone"
+#: ipalib/plugins/dns.py:2094
+msgid "Allow inline DNSSEC signing of records in the zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1764
+#: ipalib/plugins/dns.py:2182
 msgid "Create new DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1769 ipalib/plugins/dns.py:1904
-#: ipalib/plugins/dns.py:2365 ipalib/plugins/host.py:398
-#: ipalib/plugins/permission.py:298 ipalib/plugins/realmdomains.py:97
-#: ipalib/plugins/service.py:369
+#: ipalib/plugins/dns.py:2186 ipalib/plugins/dns.py:2329
+#: ipalib/plugins/dns.py:2953 ipalib/plugins/host.py:517
+#: ipalib/plugins/permission.py:991 ipalib/plugins/realmdomains.py:116
+#: ipalib/plugins/service.py:419
 msgid "Force"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1770
+#: ipalib/plugins/dns.py:2187
 msgid "Force DNS zone creation even if nameserver is not resolvable."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1773
+#: ipalib/plugins/dns.py:2190
 msgid "Add forward record for nameserver located in the created zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1774 ipalib/plugins/dns.py:1795
+#: ipalib/plugins/dns.py:2191 ipalib/plugins/dns.py:2220
 msgid "Nameserver IP address"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1801
-msgid "DNS is not configured"
-msgstr ""
-
-#: ipalib/plugins/dns.py:1811
+#: ipalib/plugins/dns.py:2235
 msgid "Nameserver address is not a domain name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1824
+#: ipalib/plugins/dns.py:2247
 msgid "Nameserver for reverse zone cannot be a relative DNS name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1828
+#: ipalib/plugins/dns.py:2251
 msgid "Nameserver DNS record is created for for forward zones only"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1832
+#: ipalib/plugins/dns.py:2256
 msgid "Nameserver DNS record is created only for nameservers in current zone"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1873
+#: ipalib/plugins/dns.py:2299
 msgid "Delete DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1875
+#: ipalib/plugins/dns.py:2301
 #, python-format
 msgid "Deleted DNS zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:1900
+#: ipalib/plugins/dns.py:2325
 msgid "Modify DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1905
+#: ipalib/plugins/dns.py:2330
 msgid "Force nameserver change even if nameserver not in DNS"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1922
-msgid "Search for DNS zones (SOA records)."
-msgstr ""
-
-#: ipalib/plugins/dns.py:1946
+#: ipalib/plugins/dns.py:2355
 msgid "Forward zones only"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1948
+#: ipalib/plugins/dns.py:2357
 msgid "Search for forward zones only"
 msgstr ""
 
-#: ipalib/plugins/dns.py:1968
+#: ipalib/plugins/dns.py:2389
 msgid "Display information about a DNS zone (SOA record)."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1976
+#: ipalib/plugins/dns.py:2400
 msgid "Disable DNS Zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:1979
+#: ipalib/plugins/dns.py:2401
 #, python-format
 msgid "Disabled DNS zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:1997
+#: ipalib/plugins/dns.py:2406
 msgid "Enable DNS Zone."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2000
+#: ipalib/plugins/dns.py:2407
 #, python-format
 msgid "Enabled DNS zone \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2017
+#: ipalib/plugins/dns.py:2412
 msgid "Add a permission for per-zone access delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2020
-#, python-format
-msgid "Added system permission \"%(value)s\""
-msgstr ""
-
-#: ipalib/plugins/dns.py:2053
+#: ipalib/plugins/dns.py:2417
 msgid "Remove a permission for per-zone access delegation."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2056
-#, python-format
-msgid "Removed system permission \"%(value)s\""
-msgstr ""
-
-#: ipalib/plugins/dns.py:2087
+#: ipalib/plugins/dns.py:2427
 msgid "DNS resource record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2088
+#: ipalib/plugins/dns.py:2428
 msgid "DNS resource records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2093
+#: ipalib/plugins/dns.py:2434
 msgid "DNS Resource Records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2094
+#: ipalib/plugins/dns.py:2435
 msgid "DNS Resource Record"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2100 ipalib/plugins/dns.py:2101
+#: ipalib/plugins/dns.py:2440 ipalib/plugins/dns.py:2441
 msgid "Record name"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2106 ipalib/plugins/dns.py:2107
-msgid "Time to live"
-msgstr ""
-
-#: ipalib/plugins/dns.py:2111 ipalib/plugins/host.py:330
+#: ipalib/plugins/dns.py:2451 ipalib/plugins/host.py:448
+#: ipalib/plugins/user.py:585
 msgid "Class"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2112
+#: ipalib/plugins/dns.py:2452
 msgid "DNS class"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2118
+#: ipalib/plugins/dns.py:2458
 msgid "Structured"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2119
+#: ipalib/plugins/dns.py:2459
 msgid "Parse all raw DNS records and return them in a structured way"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2150
+#: ipalib/plugins/dns.py:2475
+msgid "must be in zone record"
+msgstr ""
+
+#: ipalib/plugins/dns.py:2484
+msgid ""
+"out-of-zone data: record name must be a subdomain of the zone or a relative "
+"name"
+msgstr ""
+
+#: ipalib/plugins/dns.py:2511
 #, python-format
 msgid ""
 "Reverse zone for PTR record should be a sub-zone of one the following fully "
 "qualified domains: %s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2156
+#: ipalib/plugins/dns.py:2526
 #, python-format
 msgid ""
 "Reverse zone %(name)s requires exactly %(count)d IP address components, "
 "%(user_count)d given"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2328
+#: ipalib/plugins/dns.py:2567
+msgid "only master zones can contain records"
+msgstr ""
+
+#: ipalib/plugins/dns.py:2736
 msgid "only one CNAME record is allowed per name (RFC 2136, section 1.1.5)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2334
+#: ipalib/plugins/dns.py:2742
 msgid ""
 "CNAME record is not allowed to coexist with any other record (RFC 1034, "
 "section 3.6.2)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2346
+#: ipalib/plugins/dns.py:2754
 msgid "only one DNAME record is allowed per name (RFC 6672, section 2.4)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2351
+#: ipalib/plugins/dns.py:2759
 msgid ""
 "DNAME record is not allowed to coexist with an NS record except when located "
 "in a zone root record (RFC 6672, section 2.3)"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2359
+#: ipalib/plugins/dns.py:2768
+msgid "Only one NSEC3PARAM record is allowed per zone"
+msgstr ""
+
+#: ipalib/plugins/dns.py:2947
 msgid "Add new DNS resource record."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2367
+#: ipalib/plugins/dns.py:2955
 msgid "force NS record creation even if its hostname is not in DNS"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2404
+#: ipalib/plugins/dns.py:3002
 msgid "Please choose a type of DNS resource record to be added"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2405
+#: ipalib/plugins/dns.py:3003
 #, python-format
 msgid "The most common types for this type of zone are: %s\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2410
+#: ipalib/plugins/dns.py:3008
 msgid "DNS resource record type"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2426
+#: ipalib/plugins/dns.py:3024
 #, python-format
 msgid "Invalid or unsupported type. Allowed values are: %s"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2454
+#: ipalib/plugins/dns.py:3052
 #, python-format
 msgid "Raw value of a DNS record was already set by \"%(name)s\" option"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2549
+#: ipalib/plugins/dns.py:3154
 msgid "Modify a DNS resource record."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2566
+#: ipalib/plugins/dns.py:3171
 msgid "DNS zone root record cannot be renamed"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2584
+#: ipalib/plugins/dns.py:3189
 msgid "DNS records can be only updated one at a time"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2664
+#: ipalib/plugins/dns.py:3280
 msgid "No option to modify specific record provided."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2667 ipalib/plugins/dns.py:2839
+#: ipalib/plugins/dns.py:3283 ipalib/plugins/dns.py:3469
 msgid "Current DNS record contents:\n"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2689
+#: ipalib/plugins/dns.py:3305
 #, python-format
 msgid "Modify %(name)s '%(value)s'?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2697
+#: ipalib/plugins/dns.py:3313
 #, python-format
 msgid ""
 "%(count)d %(type)s record skipped. Only one value per DNS record type can be "
@@ -3569,110 +3858,181 @@ msgid_plural ""
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/dns.py:2709
+#: ipalib/plugins/dns.py:3325
 #, python-format
 msgid "Deleted record \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:2716
+#: ipalib/plugins/dns.py:3332
 msgid "Delete DNS resource record."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2720
+#: ipalib/plugins/dns.py:3336
 msgid ""
 "Neither --del-all nor options to delete a specific record provided.\n"
 "Command help may be consulted for all supported record types."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2726
+#: ipalib/plugins/dns.py:3342
 msgid "Delete all associated records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2792
+#: ipalib/plugins/dns.py:3411
 #, python-format
 msgid "Zone record '%s' cannot be deleted"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2831
+#: ipalib/plugins/dns.py:3461
 msgid "No option to delete specific record provided."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2832
+#: ipalib/plugins/dns.py:3462
 msgid "Delete all?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2860
+#: ipalib/plugins/dns.py:3490
 #, python-format
 msgid "Delete %(name)s '%(value)s'?"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2871
+#: ipalib/plugins/dns.py:3501
 msgid "Display DNS resource."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2888
+#: ipalib/plugins/dns.py:3518
 msgid "Search for DNS resources."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2923
+#: ipalib/plugins/dns.py:3557
 msgid "Resolve a host name in DNS."
 msgstr ""
 
-#: ipalib/plugins/dns.py:2926
+#: ipalib/plugins/dns.py:3560
 #, python-format
 msgid "Found '%(value)s'"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2943
+#: ipalib/plugins/dns.py:3577
 #, python-format
 msgid "Host '%(host)s' not found"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2980
+#: ipalib/plugins/dns.py:3614
 msgid "DNS configuration options"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2985 ipalib/plugins/dns.py:2986
+#: ipalib/plugins/dns.py:3619 ipalib/plugins/dns.py:3620
 msgid "DNS Global Configuration"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2992
+#: ipalib/plugins/dns.py:3626
 msgid "Global forwarders"
 msgstr ""
 
-#: ipalib/plugins/dns.py:2993
+#: ipalib/plugins/dns.py:3627
 msgid ""
 "Global forwarders. A custom port can be specified for each forwarder using a "
 "standard format \"IP_ADDRESS port PORT\""
 msgstr ""
 
-#: ipalib/plugins/dns.py:3000
+#: ipalib/plugins/dns.py:3634
 msgid ""
 "Global forwarding policy. Set to \"none\" to disable any configured global "
 "forwarders."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3007
+#: ipalib/plugins/dns.py:3641
 msgid "Allow synchronization of forward (A, AAAA) and reverse (PTR) records"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3011
+#: ipalib/plugins/dns.py:3645
 msgid "Zone refresh interval"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3025
+#: ipalib/plugins/dns.py:3689
 msgid "Global DNS configuration is empty"
 msgstr ""
 
-#: ipalib/plugins/dns.py:3031
+#: ipalib/plugins/dns.py:3695
 msgid "Modify global DNS configuration."
 msgstr ""
 
-#: ipalib/plugins/dns.py:3042
+#: ipalib/plugins/dns.py:3706
 msgid "Show the current global DNS configuration."
 msgstr ""
 
-#: ipalib/plugins/group.py:33
+#: ipalib/plugins/dns.py:3719
+msgid "DNS forward zone"
+msgstr ""
+
+#: ipalib/plugins/dns.py:3720
+msgid "DNS forward zones"
+msgstr ""
+
+#: ipalib/plugins/dns.py:3722
+msgid "DNS Forward Zones"
+msgstr ""
+
+#: ipalib/plugins/dns.py:3723
+msgid "DNS Forward Zone"
+msgstr ""
+
+#: ipalib/plugins/dns.py:3732
+msgid "Create new DNS forward zone."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3746 ipalib/plugins/dns.py:3786
+msgid "Please specify forwarders."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3753
+msgid "Delete DNS forward zone."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3755
+#, python-format
+msgid "Deleted DNS forward zone \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/dns.py:3760
+msgid "Modify DNS forward zone."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3793
+msgid "Search for DNS forward zones."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3798
+msgid "Display information about a DNS forward zone."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3805
+msgid "Disable DNS Forward Zone."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3806
+#, python-format
+msgid "Disabled DNS forward zone \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/dns.py:3811
+msgid "Enable DNS Forward Zone."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3812
+#, python-format
+msgid "Enabled DNS forward zone \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/dns.py:3817
+msgid "Add a permission for per-forward zone access delegation."
+msgstr ""
+
+#: ipalib/plugins/dns.py:3822
+msgid "Remove a permission for per-forward zone access delegation."
+msgstr ""
+
+#: ipalib/plugins/group.py:34
 msgid ""
 "\n"
 "Groups of users\n"
@@ -3764,173 +4124,173 @@ msgid ""
 "   ipa group-show ad_admins_external\n"
 msgstr ""
 
-#: ipalib/plugins/group.py:120 ipalib/plugins/group.py:229
-#: ipalib/plugins/group.py:449 ipalib/plugins/user.py:189
+#: ipalib/plugins/group.py:125 ipalib/plugins/group.py:295
+#: ipalib/plugins/group.py:532 ipalib/plugins/user.py:204
 msgid "group"
 msgstr ""
 
-#: ipalib/plugins/group.py:121
+#: ipalib/plugins/group.py:126
 msgid "groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:140 ipalib/plugins/hbacrule.py:190
-#: ipalib/plugins/internal.py:495 ipalib/plugins/selinuxusermap.py:195
-#: ipalib/plugins/sudorule.py:159
+#: ipalib/plugins/group.py:207 ipalib/plugins/hbacrule.py:244
+#: ipalib/plugins/internal.py:511 ipalib/plugins/selinuxusermap.py:238
+#: ipalib/plugins/sudorule.py:271
 msgid "User Groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:141
+#: ipalib/plugins/group.py:208
 msgid "User Group"
 msgstr ""
 
-#: ipalib/plugins/group.py:149
+#: ipalib/plugins/group.py:216
 msgid "Group name"
 msgstr ""
 
-#: ipalib/plugins/group.py:156 ipalib/plugins/sudocmdgroup.py:79
+#: ipalib/plugins/group.py:223 ipalib/plugins/sudocmdgroup.py:123
 msgid "Group description"
 msgstr ""
 
-#: ipalib/plugins/group.py:160 ipalib/plugins/user.py:311
+#: ipalib/plugins/group.py:227 ipalib/plugins/user.py:519
 msgid "GID"
 msgstr ""
 
-#: ipalib/plugins/group.py:161
+#: ipalib/plugins/group.py:228
 msgid "GID (use this option to set it manually)"
 msgstr ""
 
-#: ipalib/plugins/group.py:170
+#: ipalib/plugins/group.py:236
 msgid "External member"
 msgstr ""
 
-#: ipalib/plugins/group.py:171
+#: ipalib/plugins/group.py:237
 msgid "Members of a trusted domain in DOM\\name or name@domain form"
 msgstr ""
 
-#: ipalib/plugins/group.py:177
+#: ipalib/plugins/group.py:245
 msgid "Create a new group."
 msgstr ""
 
-#: ipalib/plugins/group.py:179
+#: ipalib/plugins/group.py:247
 #, python-format
 msgid "Added group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:184
+#: ipalib/plugins/group.py:252
 msgid "Create as a non-POSIX group"
 msgstr ""
 
-#: ipalib/plugins/group.py:189
+#: ipalib/plugins/group.py:257
 msgid "Allow adding external non-IPA members from trusted domains"
 msgstr ""
 
-#: ipalib/plugins/group.py:214
+#: ipalib/plugins/group.py:280
 msgid "Delete group."
 msgstr ""
 
-#: ipalib/plugins/group.py:216
+#: ipalib/plugins/group.py:282
 #, python-format
 msgid "Deleted group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:230
+#: ipalib/plugins/group.py:296
 msgid "privileged group"
 msgstr ""
 
-#: ipalib/plugins/group.py:248
+#: ipalib/plugins/group.py:313
 msgid "Modify a group."
 msgstr ""
 
-#: ipalib/plugins/group.py:250
+#: ipalib/plugins/group.py:315
 #, python-format
 msgid "Modified group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:255
+#: ipalib/plugins/group.py:320
 msgid "change to a POSIX group"
 msgstr ""
 
-#: ipalib/plugins/group.py:259
+#: ipalib/plugins/group.py:324
 msgid "change to support external non-IPA members from trusted domains"
 msgstr ""
 
-#: ipalib/plugins/group.py:318
+#: ipalib/plugins/group.py:384
 msgid "Search for groups."
 msgstr ""
 
-#: ipalib/plugins/group.py:323
+#: ipalib/plugins/group.py:389
 #, python-format
 msgid "%(count)d group matched"
 msgid_plural "%(count)d groups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/group.py:329
+#: ipalib/plugins/group.py:395
 msgid "search for private groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:333
+#: ipalib/plugins/group.py:399
 msgid "search for POSIX groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:337
+#: ipalib/plugins/group.py:403
 msgid ""
 "search for groups with support of external non-IPA members from trusted "
 "domains"
 msgstr ""
 
-#: ipalib/plugins/group.py:341
+#: ipalib/plugins/group.py:407
 msgid "search for non-POSIX groups"
 msgstr ""
 
-#: ipalib/plugins/group.py:388
+#: ipalib/plugins/group.py:453
 msgid "Display information about a named group."
 msgstr ""
 
-#: ipalib/plugins/group.py:394
+#: ipalib/plugins/group.py:474
 msgid "Add members to a group."
 msgstr ""
 
-#: ipalib/plugins/group.py:403 ipalib/plugins/group.py:457
-#: ipalib/plugins/hbactest.py:382
+#: ipalib/plugins/group.py:483 ipalib/plugins/group.py:540
+#: ipalib/plugins/hbactest.py:386
 msgid ""
 "Cannot perform external member validation without Samba 4 support installed. "
 "Make sure you have installed server-trust-ad sub-package of IPA on the server"
 msgstr ""
 
-#: ipalib/plugins/group.py:408 ipalib/plugins/group.py:462
-#: ipalib/plugins/trust.py:416 ipalib/plugins/trust.py:1244
+#: ipalib/plugins/group.py:488 ipalib/plugins/group.py:545
+#: ipalib/plugins/trust.py:561 ipalib/plugins/trust.py:1334
 msgid ""
 "Cannot perform join operation without own domain configured. Make sure you "
 "have run ipa-adtrust-install on the IPA server first"
 msgstr ""
 
-#: ipalib/plugins/group.py:436
+#: ipalib/plugins/group.py:519
 msgid "Remove members from a group."
 msgstr ""
 
-#: ipalib/plugins/group.py:490
+#: ipalib/plugins/group.py:576
 msgid "Detach a managed group from a user."
 msgstr ""
 
-#: ipalib/plugins/group.py:493
+#: ipalib/plugins/group.py:579
 #, python-format
 msgid "Detached group \"%(value)s\" from user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/group.py:514
+#: ipalib/plugins/group.py:600
 msgid "not allowed to modify user entries"
 msgstr ""
 
-#: ipalib/plugins/group.py:520
+#: ipalib/plugins/group.py:606
 msgid "not allowed to modify group entries"
 msgstr ""
 
-#: ipalib/plugins/group.py:539
+#: ipalib/plugins/group.py:625
 msgid "Not a managed group"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:25
+#: ipalib/plugins/hbacrule.py:26
 msgid ""
 "\n"
 "Host-based access control\n"
@@ -3981,221 +4341,207 @@ msgid ""
 "   ipa hbacrule-del allow_server\n"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:89
+#: ipalib/plugins/hbacrule.py:91
 msgid "Host-based access control commands"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:93
+#: ipalib/plugins/hbacrule.py:95
 msgid "The deny type has been deprecated."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:115
+#: ipalib/plugins/hbacrule.py:118
 msgid "HBAC rule"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:116
+#: ipalib/plugins/hbacrule.py:119
 msgid "HBAC rules"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:134
+#: ipalib/plugins/hbacrule.py:188
 msgid "HBAC Rules"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:135 ipalib/plugins/selinuxusermap.py:167
+#: ipalib/plugins/hbacrule.py:189 ipalib/plugins/selinuxusermap.py:210
 msgid "HBAC Rule"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:140 ipalib/plugins/selinuxusermap.py:158
-#: ipalib/plugins/sudorule.py:106
+#: ipalib/plugins/hbacrule.py:194 ipalib/plugins/selinuxusermap.py:201
+#: ipalib/plugins/sudorule.py:218
 msgid "Rule name"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:145
+#: ipalib/plugins/hbacrule.py:199
 msgid "Rule type (allow)"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:146
+#: ipalib/plugins/hbacrule.py:200
 msgid "Rule type"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:156 ipalib/plugins/netgroup.py:139
-#: ipalib/plugins/selinuxusermap.py:172 ipalib/plugins/sudorule.py:119
+#: ipalib/plugins/hbacrule.py:210 ipalib/plugins/netgroup.py:196
+#: ipalib/plugins/selinuxusermap.py:215 ipalib/plugins/sudorule.py:231
 msgid "User category"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:157 ipalib/plugins/netgroup.py:140
-#: ipalib/plugins/selinuxusermap.py:173 ipalib/plugins/sudorule.py:120
+#: ipalib/plugins/hbacrule.py:211 ipalib/plugins/netgroup.py:197
+#: ipalib/plugins/selinuxusermap.py:216 ipalib/plugins/sudorule.py:232
 msgid "User category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:162 ipalib/plugins/netgroup.py:145
-#: ipalib/plugins/selinuxusermap.py:178 ipalib/plugins/sudorule.py:125
+#: ipalib/plugins/hbacrule.py:216 ipalib/plugins/netgroup.py:202
+#: ipalib/plugins/selinuxusermap.py:221 ipalib/plugins/sudorule.py:237
 msgid "Host category"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:163 ipalib/plugins/netgroup.py:146
-#: ipalib/plugins/selinuxusermap.py:179 ipalib/plugins/sudorule.py:126
+#: ipalib/plugins/hbacrule.py:217 ipalib/plugins/netgroup.py:203
+#: ipalib/plugins/selinuxusermap.py:222 ipalib/plugins/sudorule.py:238
 msgid "Host category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:169
+#: ipalib/plugins/hbacrule.py:223
 msgid "Service category"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:170
+#: ipalib/plugins/hbacrule.py:224
 msgid "Service category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:182 ipalib/plugins/internal.py:658
-#: ipalib/plugins/selinuxusermap.py:187 ipalib/plugins/sudorule.py:114
+#: ipalib/plugins/hbacrule.py:236 ipalib/plugins/internal.py:686
+#: ipalib/plugins/selinuxusermap.py:230 ipalib/plugins/sudorule.py:226
 msgid "Enabled"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:186 ipalib/plugins/internal.py:496
-#: ipalib/plugins/selinuxusermap.py:191 ipalib/plugins/sudorule.py:155
-#: ipalib/plugins/user.py:225
-msgid "Users"
-msgstr ""
-
-#: ipalib/plugins/hbacrule.py:194 ipalib/plugins/host.py:255
-#: ipalib/plugins/internal.py:490 ipalib/plugins/selinuxusermap.py:199
-#: ipalib/plugins/sudorule.py:163
-msgid "Hosts"
-msgstr ""
-
-#: ipalib/plugins/hbacrule.py:198 ipalib/plugins/hostgroup.py:75
-#: ipalib/plugins/internal.py:489 ipalib/plugins/selinuxusermap.py:203
-#: ipalib/plugins/sudorule.py:167
+#: ipalib/plugins/hbacrule.py:252 ipalib/plugins/hostgroup.py:129
+#: ipalib/plugins/internal.py:505 ipalib/plugins/selinuxusermap.py:246
+#: ipalib/plugins/sudorule.py:284
 msgid "Host Groups"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:204 ipalib/plugins/internal.py:437
-#: ipalib/plugins/service.py:315
+#: ipalib/plugins/hbacrule.py:258 ipalib/plugins/internal.py:453
+#: ipalib/plugins/service.py:365
 msgid "Services"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:208
+#: ipalib/plugins/hbacrule.py:262
 msgid "Service Groups"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:218
+#: ipalib/plugins/hbacrule.py:272
 msgid "Create a new HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:220
+#: ipalib/plugins/hbacrule.py:274
 #, python-format
 msgid "Added HBAC rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:232
+#: ipalib/plugins/hbacrule.py:286
 msgid "Delete an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:234
+#: ipalib/plugins/hbacrule.py:288
 #, python-format
 msgid "Deleted HBAC rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:249
+#: ipalib/plugins/hbacrule.py:303
 msgid "Modify an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:251
+#: ipalib/plugins/hbacrule.py:305
 #, python-format
 msgid "Modified HBAC rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:261 ipalib/plugins/netgroup.py:213
-#: ipalib/plugins/sudorule.py:289
+#: ipalib/plugins/hbacrule.py:316 ipalib/plugins/netgroup.py:269
 msgid "user category cannot be set to 'all' while there are allowed users"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:263 ipalib/plugins/netgroup.py:215
-#: ipalib/plugins/sudorule.py:291
+#: ipalib/plugins/hbacrule.py:318 ipalib/plugins/netgroup.py:271
 msgid "host category cannot be set to 'all' while there are allowed hosts"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:265
+#: ipalib/plugins/hbacrule.py:320
 msgid ""
 "service category cannot be set to 'all' while there are allowed services"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:272
+#: ipalib/plugins/hbacrule.py:327
 msgid "Search for HBAC rules."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:275
+#: ipalib/plugins/hbacrule.py:330
 #, python-format
 msgid "%(count)d HBAC rule matched"
 msgid_plural "%(count)d HBAC rules matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/hbacrule.py:282
+#: ipalib/plugins/hbacrule.py:337
 msgid "Display the properties of an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:288
+#: ipalib/plugins/hbacrule.py:343
 msgid "Enable an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:290
+#: ipalib/plugins/hbacrule.py:345
 #, python-format
 msgid "Enabled HBAC rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:315
+#: ipalib/plugins/hbacrule.py:373
 msgid "Disable an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:317
+#: ipalib/plugins/hbacrule.py:375
 #, python-format
 msgid "Disabled HBAC rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:349 ipalib/plugins/hbacrule.py:389
+#: ipalib/plugins/hbacrule.py:409 ipalib/plugins/hbacrule.py:449
 msgid "Access time"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:423
+#: ipalib/plugins/hbacrule.py:484
 msgid "Add users and groups to an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:437 ipalib/plugins/selinuxusermap.py:460
-#: ipalib/plugins/sudorule.py:439
+#: ipalib/plugins/hbacrule.py:499 ipalib/plugins/selinuxusermap.py:509
+#: ipalib/plugins/sudorule.py:590
 msgid "users cannot be added when user category='all'"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:444
+#: ipalib/plugins/hbacrule.py:506
 msgid "Remove users and groups from an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:453
+#: ipalib/plugins/hbacrule.py:515
 msgid "Add target hosts and hostgroups to an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:467 ipalib/plugins/selinuxusermap.py:492
-#: ipalib/plugins/sudorule.py:475
+#: ipalib/plugins/hbacrule.py:530 ipalib/plugins/selinuxusermap.py:542
+#: ipalib/plugins/sudorule.py:644
 msgid "hosts cannot be added when host category='all'"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:474
+#: ipalib/plugins/hbacrule.py:537
 msgid "Remove target hosts and hostgroups from an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:507
+#: ipalib/plugins/hbacrule.py:570
 msgid "Add services to an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:521
+#: ipalib/plugins/hbacrule.py:585
 msgid "services cannot be added when service category='all'"
 msgstr ""
 
-#: ipalib/plugins/hbacrule.py:528
+#: ipalib/plugins/hbacrule.py:592
 msgid "Remove service and service groups from an HBAC rule."
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:27
+#: ipalib/plugins/hbacsvc.py:28
 msgid ""
 "\n"
 "HBAC Services\n"
@@ -4220,77 +4566,77 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:50 ipalib/plugins/hbacsvcgroup.py:45
+#: ipalib/plugins/hbacsvc.py:53 ipalib/plugins/hbacsvcgroup.py:48
 msgid "Host based access control commands"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:57 ipalib/plugins/hbacsvc.py:73
+#: ipalib/plugins/hbacsvc.py:61 ipalib/plugins/hbacsvc.py:102
 msgid "HBAC service"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:58
+#: ipalib/plugins/hbacsvc.py:62
 msgid "HBAC services"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:66
+#: ipalib/plugins/hbacsvc.py:95
 msgid "HBAC Services"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:67
+#: ipalib/plugins/hbacsvc.py:96
 msgid "HBAC Service"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:72
+#: ipalib/plugins/hbacsvc.py:101
 msgid "Service name"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:80
+#: ipalib/plugins/hbacsvc.py:109
 msgid "HBAC service description"
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:88
+#: ipalib/plugins/hbacsvc.py:117
 msgid "Add a new HBAC service."
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:90
+#: ipalib/plugins/hbacsvc.py:119
 #, python-format
 msgid "Added HBAC service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:96
+#: ipalib/plugins/hbacsvc.py:125
 msgid "Delete an existing HBAC service."
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:98
+#: ipalib/plugins/hbacsvc.py:127
 #, python-format
 msgid "Deleted HBAC service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:104
+#: ipalib/plugins/hbacsvc.py:133
 msgid "Modify an HBAC service."
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:106
+#: ipalib/plugins/hbacsvc.py:135
 #, python-format
 msgid "Modified HBAC service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:112
+#: ipalib/plugins/hbacsvc.py:141
 msgid "Search for HBAC services."
 msgstr ""
 
-#: ipalib/plugins/hbacsvc.py:115
+#: ipalib/plugins/hbacsvc.py:144
 #, python-format
 msgid "%(count)d HBAC service matched"
 msgid_plural "%(count)d HBAC services matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/hbacsvc.py:122
+#: ipalib/plugins/hbacsvc.py:151
 msgid "Display information about an HBAC service."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:24
+#: ipalib/plugins/hbacsvcgroup.py:25
 msgid ""
 "\n"
 "HBAC Service Groups\n"
@@ -4313,81 +4659,81 @@ msgid ""
 "   ipa hbacsvcgroup-del login\n"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:52
+#: ipalib/plugins/hbacsvcgroup.py:56
 msgid "HBAC service group"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:53
+#: ipalib/plugins/hbacsvcgroup.py:57
 msgid "HBAC service groups"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:61
+#: ipalib/plugins/hbacsvcgroup.py:100
 msgid "HBAC Service Groups"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:62
+#: ipalib/plugins/hbacsvcgroup.py:101
 msgid "HBAC Service Group"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:67
+#: ipalib/plugins/hbacsvcgroup.py:106
 msgid "Service group name"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:74
+#: ipalib/plugins/hbacsvcgroup.py:113
 msgid "HBAC service group description"
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:82
+#: ipalib/plugins/hbacsvcgroup.py:121
 msgid "Add a new HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:84
+#: ipalib/plugins/hbacsvcgroup.py:123
 #, python-format
 msgid "Added HBAC service group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:90
+#: ipalib/plugins/hbacsvcgroup.py:129
 msgid "Delete an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:92
+#: ipalib/plugins/hbacsvcgroup.py:131
 #, python-format
 msgid "Deleted HBAC service group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:98
+#: ipalib/plugins/hbacsvcgroup.py:137
 msgid "Modify an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:100
+#: ipalib/plugins/hbacsvcgroup.py:139
 #, python-format
 msgid "Modified HBAC service group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:106
+#: ipalib/plugins/hbacsvcgroup.py:145
 msgid "Search for an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:109
+#: ipalib/plugins/hbacsvcgroup.py:148
 #, python-format
 msgid "%(count)d HBAC service group matched"
 msgid_plural "%(count)d HBAC service groups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/hbacsvcgroup.py:116
+#: ipalib/plugins/hbacsvcgroup.py:155
 msgid "Display information about an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:122
+#: ipalib/plugins/hbacsvcgroup.py:161
 msgid "Add members to an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbacsvcgroup.py:128
+#: ipalib/plugins/hbacsvcgroup.py:167
 msgid "Remove members from an HBAC service group."
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:35
+#: ipalib/plugins/hbactest.py:36
 msgid ""
 "\n"
 "Simulate use of Host-based access controls\n"
@@ -4585,75 +4931,75 @@ msgid ""
 "      Not matched rules: can_login\n"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:241
+#: ipalib/plugins/hbactest.py:245
 msgid "Simulate use of Host-based access controls"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:245
+#: ipalib/plugins/hbactest.py:249
 msgid "Warning"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:246
+#: ipalib/plugins/hbactest.py:250
 msgid "Matched rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:247
+#: ipalib/plugins/hbactest.py:251
 msgid "Not matched rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:248
+#: ipalib/plugins/hbactest.py:252
 msgid "Non-existent or invalid rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:249
+#: ipalib/plugins/hbactest.py:253
 msgid "Result of simulation"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:255 ipalib/plugins/krbtpolicy.py:85
-#: ipalib/plugins/passwd.py:70
+#: ipalib/plugins/hbactest.py:259 ipalib/plugins/krbtpolicy.py:124
+#: ipalib/plugins/passwd.py:74
 msgid "User name"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:261
+#: ipalib/plugins/hbactest.py:265
 msgid "Target host"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:269
+#: ipalib/plugins/hbactest.py:273
 msgid "Rules to test. If not specified, --enabled is assumed"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:274
+#: ipalib/plugins/hbactest.py:278
 msgid "Hide details which rules are matched, not matched, or invalid"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:278
+#: ipalib/plugins/hbactest.py:282
 msgid "Include all enabled IPA rules into test [default]"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:282
+#: ipalib/plugins/hbactest.py:286
 msgid "Include all disabled IPA rules into test"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:286
+#: ipalib/plugins/hbactest.py:290
 msgid "Maximum number of rules to process when no --rules is specified"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:364
+#: ipalib/plugins/hbactest.py:368
 msgid "Unresolved rules in --rules"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:388 ipalib/plugins/trust.py:555
+#: ipalib/plugins/hbactest.py:392 ipalib/plugins/trust.py:230
 msgid ""
 "Cannot search in trusted domains without own domain configured. Make sure "
 "you have run ipa-adtrust-install on the IPA server first"
 msgstr ""
 
-#: ipalib/plugins/hbactest.py:472
+#: ipalib/plugins/hbactest.py:478
 #, python-format
 msgid "Access granted: %s"
 msgstr ""
 
-#: ipalib/plugins/host.py:48
+#: ipalib/plugins/host.py:49
 msgid ""
 "\n"
 "Hosts/Machines\n"
@@ -4665,7 +5011,7 @@ msgid ""
 "- every enrolled client generates a host entry\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:56
+#: ipalib/plugins/host.py:57
 msgid ""
 "\n"
 "ENROLLMENT:\n"
@@ -4681,7 +5027,7 @@ msgid ""
 "3. The host has been created with a one-time password.\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:68
+#: ipalib/plugins/host.py:69
 msgid ""
 "\n"
 "RE-ENROLLMENT:\n"
@@ -4696,13 +5042,7 @@ msgid ""
 "the OS that it runs, etc.\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:78
-msgid ""
-"\n"
-"EXAMPLES:\n"
-msgstr ""
-
-#: ipalib/plugins/host.py:80
+#: ipalib/plugins/host.py:81
 msgid ""
 "\n"
 " Add a new host:\n"
@@ -4710,274 +5050,279 @@ msgid ""
 "com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:83
+#: ipalib/plugins/host.py:84
 msgid ""
 "\n"
 " Delete a host:\n"
 "   ipa host-del test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:86
+#: ipalib/plugins/host.py:87
 msgid ""
 "\n"
 " Add a new host with a one-time password:\n"
 "   ipa host-add --os='Fedora 12' --password=Secret123 test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:89
+#: ipalib/plugins/host.py:90
 msgid ""
 "\n"
 " Add a new host with a random one-time password:\n"
 "   ipa host-add --os='Fedora 12' --random test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:92
+#: ipalib/plugins/host.py:93
 msgid ""
 "\n"
 " Modify information about a host:\n"
 "   ipa host-mod --os='Fedora 12' test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:95
+#: ipalib/plugins/host.py:96
 msgid ""
 "\n"
 " Remove SSH public keys of a host and update DNS to reflect this change:\n"
 "   ipa host-mod --sshpubkey= --updatedns test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:98
+#: ipalib/plugins/host.py:99
 msgid ""
 "\n"
 " Disable the host Kerberos key, SSL certificate and all of its services:\n"
 "   ipa host-disable test.example.com\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:101
+#: ipalib/plugins/host.py:102
 msgid ""
 "\n"
 " Add a host that can manage this host's keytab and certificate:\n"
 "   ipa host-add-managedby --hosts=test2 test\n"
 msgstr ""
 
-#: ipalib/plugins/host.py:157 ipalib/plugins/service.py:96
+#: ipalib/plugins/host.py:160 ipalib/plugins/service.py:99
 msgid "Keytab"
 msgstr ""
 
-#: ipalib/plugins/host.py:169 ipalib/plugins/internal.py:363
-#: ipalib/plugins/service.py:105
+#: ipalib/plugins/host.py:172 ipalib/plugins/internal.py:376
+#: ipalib/plugins/service.py:108
 msgid "Serial Number"
 msgstr ""
 
-#: ipalib/plugins/host.py:172 ipalib/plugins/internal.py:364
-#: ipalib/plugins/service.py:108
+#: ipalib/plugins/host.py:175 ipalib/plugins/internal.py:377
+#: ipalib/plugins/service.py:111
 msgid "Serial Number (hex)"
 msgstr ""
 
-#: ipalib/plugins/host.py:193
+#: ipalib/plugins/host.py:196
 msgid "Failed managedby"
 msgstr ""
 
-#: ipalib/plugins/host.py:196 ipalib/plugins/user.py:92
+#: ipalib/plugins/host.py:199 ipalib/plugins/user.py:95
 msgid "SSH public key fingerprint"
 msgstr ""
 
-#: ipalib/plugins/host.py:222
+#: ipalib/plugins/host.py:224
+#, python-format
+msgid "invalid domain-name: %s"
+msgstr ""
+
+#: ipalib/plugins/host.py:235 ipalib/plugins/sudorule.py:424
 msgid "host"
 msgstr ""
 
-#: ipalib/plugins/host.py:223
+#: ipalib/plugins/host.py:236 ipalib/plugins/sudorule.py:424
 msgid "hosts"
 msgstr ""
 
-#: ipalib/plugins/host.py:256 ipalib/plugins/internal.py:488
-#: ipalib/plugins/internal.py:539
+#: ipalib/plugins/host.py:374 ipalib/plugins/internal.py:504
+#: ipalib/plugins/internal.py:562
 msgid "Host"
 msgstr ""
 
-#: ipalib/plugins/host.py:261
+#: ipalib/plugins/host.py:379
 msgid "Host name"
 msgstr ""
 
-#: ipalib/plugins/host.py:268
+#: ipalib/plugins/host.py:386
 msgid "A description of this host"
 msgstr ""
 
-#: ipalib/plugins/host.py:272
+#: ipalib/plugins/host.py:390
 msgid "Locality"
 msgstr ""
 
-#: ipalib/plugins/host.py:273
+#: ipalib/plugins/host.py:391
 msgid "Host locality (e.g. \"Baltimore, MD\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:278
+#: ipalib/plugins/host.py:396
 msgid "Host location (e.g. \"Lab 2\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:282
+#: ipalib/plugins/host.py:400
 msgid "Platform"
 msgstr ""
 
-#: ipalib/plugins/host.py:283
+#: ipalib/plugins/host.py:401
 msgid "Host hardware platform (e.g. \"Lenovo T61\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:287
+#: ipalib/plugins/host.py:405
 msgid "Operating system"
 msgstr ""
 
-#: ipalib/plugins/host.py:288
+#: ipalib/plugins/host.py:406
 msgid "Host operating system and version (e.g. \"Fedora 9\")"
 msgstr ""
 
-#: ipalib/plugins/host.py:292
+#: ipalib/plugins/host.py:410
 msgid "User password"
 msgstr ""
 
-#: ipalib/plugins/host.py:293
+#: ipalib/plugins/host.py:411
 msgid "Password used in bulk enrollment"
 msgstr ""
 
-#: ipalib/plugins/host.py:296
+#: ipalib/plugins/host.py:414
 msgid "Generate a random password to be used in bulk enrollment"
 msgstr ""
 
-#: ipalib/plugins/host.py:301 ipalib/plugins/user.py:301
+#: ipalib/plugins/host.py:419 ipalib/plugins/user.py:509
 msgid "Random password"
 msgstr ""
 
-#: ipalib/plugins/host.py:307 ipalib/plugins/service.py:329
+#: ipalib/plugins/host.py:425 ipalib/plugins/service.py:379
 msgid "Base-64 encoded server certificate"
 msgstr ""
 
-#: ipalib/plugins/host.py:310 ipalib/plugins/host.py:628
+#: ipalib/plugins/host.py:428 ipalib/plugins/host.py:751
 msgid "Principal name"
 msgstr ""
 
-#: ipalib/plugins/host.py:318
+#: ipalib/plugins/host.py:436
 msgid "MAC address"
 msgstr ""
 
-#: ipalib/plugins/host.py:319
+#: ipalib/plugins/host.py:437
 msgid "Hardware MAC address(es) on this host"
 msgstr ""
 
-#: ipalib/plugins/host.py:323 ipalib/plugins/user.py:363
+#: ipalib/plugins/host.py:441 ipalib/plugins/user.py:571
 msgid "SSH public key"
 msgstr ""
 
-#: ipalib/plugins/host.py:331
+#: ipalib/plugins/host.py:449
 msgid ""
 "Host category (semantics placed on this attribute are for local "
 "interpretation)"
 msgstr ""
 
-#: ipalib/plugins/host.py:391
+#: ipalib/plugins/host.py:510
 msgid "Add a new host."
 msgstr ""
 
-#: ipalib/plugins/host.py:394
+#: ipalib/plugins/host.py:513
 #, python-format
 msgid "Added host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:399
+#: ipalib/plugins/host.py:518
 msgid "force host name even if not in DNS"
 msgstr ""
 
-#: ipalib/plugins/host.py:402
+#: ipalib/plugins/host.py:521
 msgid "skip reverse DNS detection"
 msgstr ""
 
-#: ipalib/plugins/host.py:405
+#: ipalib/plugins/host.py:524
 msgid "Add the host to DNS with this IP address"
 msgstr ""
 
-#: ipalib/plugins/host.py:486
+#: ipalib/plugins/host.py:609
 #, python-format
 msgid "The host was added but the DNS update failed with: %(exc)s"
 msgstr ""
 
-#: ipalib/plugins/host.py:507
+#: ipalib/plugins/host.py:630
 msgid "Delete a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:509
+#: ipalib/plugins/host.py:632
 #, python-format
 msgid "Deleted host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:514
+#: ipalib/plugins/host.py:637
 msgid "Remove entries from DNS"
 msgstr ""
 
-#: ipalib/plugins/host.py:619
+#: ipalib/plugins/host.py:742
 msgid "Modify information about a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:622
+#: ipalib/plugins/host.py:745
 #, python-format
 msgid "Modified host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:629
+#: ipalib/plugins/host.py:752
 msgid "Kerberos principal name for this host"
 msgstr ""
 
-#: ipalib/plugins/host.py:633
+#: ipalib/plugins/host.py:756
 msgid "Update DNS entries"
 msgstr ""
 
-#: ipalib/plugins/host.py:646
+#: ipalib/plugins/host.py:769
 msgid "Password cannot be set on enrolled host."
 msgstr ""
 
-#: ipalib/plugins/host.py:650
+#: ipalib/plugins/host.py:773
 msgid "cn is immutable"
 msgstr ""
 
-#: ipalib/plugins/host.py:769
+#: ipalib/plugins/host.py:890
 msgid "Search for hosts."
 msgstr ""
 
-#: ipalib/plugins/host.py:773
+#: ipalib/plugins/host.py:894
 #, python-format
 msgid "%(count)d host matched"
 msgid_plural "%(count)d hosts matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/host.py:855
+#: ipalib/plugins/host.py:975
 msgid "Display information about a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:860 ipalib/plugins/service.py:560
+#: ipalib/plugins/host.py:980 ipalib/plugins/service.py:608
 msgid "file to store certificate in"
 msgstr ""
 
-#: ipalib/plugins/host.py:892 ipalib/plugins/service.py:580
+#: ipalib/plugins/host.py:1012 ipalib/plugins/service.py:628
 #, python-format
 msgid "Certificate stored in file '%(file)s'"
 msgstr ""
 
-#: ipalib/plugins/host.py:903
+#: ipalib/plugins/host.py:1023
 msgid "Disable the Kerberos key, SSL certificate and all services of a host."
 msgstr ""
 
-#: ipalib/plugins/host.py:906
+#: ipalib/plugins/host.py:1026
 #, python-format
 msgid "Disabled host \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/host.py:999
+#: ipalib/plugins/host.py:1120
 msgid "Add hosts that can manage this host."
 msgstr ""
 
-#: ipalib/plugins/host.py:1014
+#: ipalib/plugins/host.py:1135 ipalib/plugins/otptoken.py:390
 msgid "Remove hosts that can manage this host."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:26
+#: ipalib/plugins/hostgroup.py:27
 msgid ""
 "\n"
 "Groups of hosts.\n"
@@ -5009,88 +5354,88 @@ msgid ""
 "   ipa hostgroup-del baltimore\n"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:61
+#: ipalib/plugins/hostgroup.py:65
 msgid "host group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:62
+#: ipalib/plugins/hostgroup.py:66
 msgid "host groups"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:76
+#: ipalib/plugins/hostgroup.py:130
 msgid "Host Group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:83
+#: ipalib/plugins/hostgroup.py:137
 msgid "Host-group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:84
+#: ipalib/plugins/hostgroup.py:138
 msgid "Name of host-group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:91
+#: ipalib/plugins/hostgroup.py:145
 msgid "A description of this host-group"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:118
+#: ipalib/plugins/hostgroup.py:172
 msgid "Add a new hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:120
+#: ipalib/plugins/hostgroup.py:174
 #, python-format
 msgid "Added hostgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:136
+#: ipalib/plugins/hostgroup.py:190
 #, python-format
 msgid ""
 "netgroup with name \"%s\" already exists. Hostgroups and netgroups share a "
 "common namespace"
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:159
+#: ipalib/plugins/hostgroup.py:213
 msgid "Delete a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:161
+#: ipalib/plugins/hostgroup.py:215
 #, python-format
 msgid "Deleted hostgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:167
+#: ipalib/plugins/hostgroup.py:221
 msgid "Modify a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:169
+#: ipalib/plugins/hostgroup.py:223
 #, python-format
 msgid "Modified hostgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:180
+#: ipalib/plugins/hostgroup.py:234
 msgid "Search for hostgroups."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:184
+#: ipalib/plugins/hostgroup.py:238
 #, python-format
 msgid "%(count)d hostgroup matched"
 msgid_plural "%(count)d hostgroups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/hostgroup.py:199
+#: ipalib/plugins/hostgroup.py:252
 msgid "Display information about a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:210
+#: ipalib/plugins/hostgroup.py:263
 msgid "Add members to a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/hostgroup.py:221
+#: ipalib/plugins/hostgroup.py:274
 msgid "Remove members from a hostgroup."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:33
+#: ipalib/plugins/idrange.py:34
 msgid ""
 "\n"
 "ID ranges\n"
@@ -5238,94 +5583,95 @@ msgid ""
 "modified to match the new range.\n"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:169
+#: ipalib/plugins/idrange.py:185
 msgid "ID Ranges"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:170
+#: ipalib/plugins/idrange.py:186
 msgid "ID Range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:173
+#: ipalib/plugins/idrange.py:189
 msgid "local domain range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:174
+#: ipalib/plugins/idrange.py:190
 msgid "Active Directory winsync range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:175 ipalib/plugins/trust.py:289
+#: ipalib/plugins/idrange.py:191 ipalib/plugins/trust.py:425
 msgid "Active Directory domain range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:176 ipalib/plugins/trust.py:290
+#: ipalib/plugins/idrange.py:192 ipalib/plugins/trust.py:426
 msgid "Active Directory trust range with POSIX attributes"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:178
+#: ipalib/plugins/idrange.py:194
 msgid "IPA trust range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:184
+#: ipalib/plugins/idrange.py:200
 msgid "Range name"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:189
+#: ipalib/plugins/idrange.py:205
 msgid "First Posix ID of the range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:193
+#: ipalib/plugins/idrange.py:209
 msgid "Number of IDs in the range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:197
+#: ipalib/plugins/idrange.py:213
 msgid "First RID of the corresponding RID range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:201
+#: ipalib/plugins/idrange.py:217
 msgid "First RID of the secondary RID range"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:206
+#: ipalib/plugins/idrange.py:222
 msgid "Domain SID of the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:211
+#: ipalib/plugins/idrange.py:227
 msgid "Name of the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:214 ipalib/plugins/internal.py:517
-#: ipalib/plugins/trust.py:323
+#: ipalib/plugins/idrange.py:230 ipalib/plugins/internal.py:537
+#: ipalib/plugins/trust.py:459
 msgid "Range type"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:216
+#: ipalib/plugins/idrange.py:232
+#, python-brace-format
 msgid "ID range type, one of {vals}"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:284
+#: ipalib/plugins/idrange.py:300
 msgid ""
 "range modification leaving objects with ID out of the defined range is not "
 "allowed"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:289
+#: ipalib/plugins/idrange.py:305
 msgid ""
 "Cannot perform SID validation without Samba 4 support installed. Make sure "
 "you have installed server-trust-ad sub-package of IPA on the server"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:296
+#: ipalib/plugins/idrange.py:312
 msgid ""
 "Cross-realm trusts are not configured. Make sure you have run ipa-adtrust-"
 "install on the IPA server first"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:308
+#: ipalib/plugins/idrange.py:324
 msgid "SID is not recognized as a valid SID for a trusted domain"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:344
+#: ipalib/plugins/idrange.py:361
 msgid ""
 "\n"
 "    Add new ID range.\n"
@@ -5365,754 +5711,814 @@ msgid ""
 "    "
 msgstr ""
 
-#: ipalib/plugins/idrange.py:376
+#: ipalib/plugins/idrange.py:393
 #, python-format
 msgid "Added ID range \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idrange.py:449 ipalib/plugins/idrange.py:647
+#: ipalib/plugins/idrange.py:466 ipalib/plugins/idrange.py:680
 msgid "Options dom-sid and dom-name cannot be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:459 ipalib/plugins/idrange.py:659
+#: ipalib/plugins/idrange.py:476 ipalib/plugins/idrange.py:692
 msgid ""
 "SID for the specified trusted domain name could not be found. Please specify "
 "the SID directly using dom-sid option."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:474
+#: ipalib/plugins/idrange.py:491
 msgid ""
 "IPA Range type must be one of ipa-ad-trust or ipa-ad-trust-posix when SID of "
 "the trusted domain is specified."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:480
+#: ipalib/plugins/idrange.py:497
 msgid "Options dom-sid/dom-name and secondary-rid-base cannot be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:485
+#: ipalib/plugins/idrange.py:502
 msgid "Options dom-sid/dom-name and rid-base must be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:504
+#: ipalib/plugins/idrange.py:521
 msgid ""
 "IPA Range type must not be one of ipa-ad-trust or ipa-ad-trust-posix when "
 "SID of the trusted domain is not specified."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:511 ipalib/plugins/idrange.py:689
+#: ipalib/plugins/idrange.py:528 ipalib/plugins/idrange.py:722
 msgid "Options secondary-rid-base and rid-base must be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:521 ipalib/plugins/idrange.py:712
+#: ipalib/plugins/idrange.py:538 ipalib/plugins/idrange.py:745
 msgid "Primary RID range and secondary RID range cannot overlap"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:533
+#: ipalib/plugins/idrange.py:550
 msgid ""
 "You must specify both rid-base and secondary-rid-base options, because ipa-"
 "adtrust-install has already been run."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:548
+#: ipalib/plugins/idrange.py:566
 msgid "Delete an ID range."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:550
+#: ipalib/plugins/idrange.py:568
 #, python-format
 msgid "Deleted ID range \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idrange.py:583
+#: ipalib/plugins/idrange.py:614
 msgid "Search for ranges."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:586
+#: ipalib/plugins/idrange.py:617
 #, python-format
 msgid "%(count)d range matched"
 msgid_plural "%(count)d ranges matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/idrange.py:604
+#: ipalib/plugins/idrange.py:636
 msgid "Display information about a range."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:618
+#: ipalib/plugins/idrange.py:651
 msgid "Modify ID range."
 msgstr ""
 
-#: ipalib/plugins/idrange.py:620
+#: ipalib/plugins/idrange.py:653
 #, python-format
 msgid "Modified ID range \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/idrange.py:666
+#: ipalib/plugins/idrange.py:699
 msgid "Options dom-sid and secondary-rid-base cannot be used together"
 msgstr ""
 
-#: ipalib/plugins/idrange.py:671
+#: ipalib/plugins/idrange.py:704
 msgid "Options dom-sid and rid-base must be used together"
 msgstr ""
 
-#: ipalib/plugins/internal.py:44 ipalib/plugins/internal.py:53
+#: ipalib/plugins/internal.py:48 ipalib/plugins/internal.py:57
 msgid "Name of object to export"
 msgstr ""
 
-#: ipalib/plugins/internal.py:47 ipalib/plugins/internal.py:56
+#: ipalib/plugins/internal.py:51 ipalib/plugins/internal.py:60
 msgid "Name of method to export"
 msgstr ""
 
-#: ipalib/plugins/internal.py:59
+#: ipalib/plugins/internal.py:63
 msgid "Name of command to export"
 msgstr ""
 
-#: ipalib/plugins/internal.py:64
+#: ipalib/plugins/internal.py:68
 msgid "Dict of JSON encoded IPA Objects"
 msgstr ""
 
-#: ipalib/plugins/internal.py:65
+#: ipalib/plugins/internal.py:69
 msgid "Dict of JSON encoded IPA Methods"
 msgstr ""
 
-#: ipalib/plugins/internal.py:66
+#: ipalib/plugins/internal.py:70
 msgid "Dict of JSON encoded IPA Commands"
 msgstr ""
 
-#: ipalib/plugins/internal.py:147
+#: ipalib/plugins/internal.py:151
 msgid "Your session has expired. Please re-login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:151
+#: ipalib/plugins/internal.py:155
 msgid "Apply"
 msgstr ""
 
-#: ipalib/plugins/internal.py:152
-msgid "Are you sure you want to proceed with the action."
+#: ipalib/plugins/internal.py:156
+msgid "Rebuild auto membership"
 msgstr ""
 
-#: ipalib/plugins/internal.py:153
-msgid "Are you sure you want to delete ${object}"
+#: ipalib/plugins/internal.py:157
+msgid "Are you sure you want to rebuild auto membership?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:154
-msgid "Are you sure you want to disable ${object}"
+#: ipalib/plugins/internal.py:159
+msgid "Are you sure you want to proceed with the action?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:155
-msgid "Are you sure you want to enable ${object}"
+#: ipalib/plugins/internal.py:160
+#, python-brace-format
+msgid "Are you sure you want to delete ${object}?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:156
+#: ipalib/plugins/internal.py:161
+#, python-brace-format
+msgid "Are you sure you want to disable ${object}?"
+msgstr ""
+
+#: ipalib/plugins/internal.py:162
+#, python-brace-format
+msgid "Are you sure you want to enable ${object}?"
+msgstr ""
+
+#: ipalib/plugins/internal.py:163
 msgid "Actions"
 msgstr ""
 
-#: ipalib/plugins/internal.py:160
+#: ipalib/plugins/internal.py:167
+#, python-brace-format
 msgid "Add RunAs ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:161
+#: ipalib/plugins/internal.py:168
+#, python-brace-format
 msgid "Add RunAs Groups into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:162
+#: ipalib/plugins/internal.py:169
+#, python-brace-format
 msgid "Add ${other_entity} Managing ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:163
+#: ipalib/plugins/internal.py:170
+#, python-brace-format
 msgid "Add ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:164
+#: ipalib/plugins/internal.py:171
+#, python-brace-format
 msgid "Add Allow ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:165
+#: ipalib/plugins/internal.py:172
+#, python-brace-format
 msgid "Add Deny ${other_entity} into ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:166
+#: ipalib/plugins/internal.py:173
+#, python-brace-format
 msgid "Add ${entity} ${primary_key} into ${other_entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:168
+#: ipalib/plugins/internal.py:175
+#, python-brace-format
 msgid "${count} item(s) added"
 msgstr ""
 
-#: ipalib/plugins/internal.py:169
+#: ipalib/plugins/internal.py:176
 msgid "Direct Membership"
 msgstr ""
 
-#: ipalib/plugins/internal.py:170
+#: ipalib/plugins/internal.py:177
+#, python-brace-format
+msgid "Filter available ${other_entity}"
+msgstr ""
+
+#: ipalib/plugins/internal.py:178
 msgid "Indirect Membership"
 msgstr ""
 
-#: ipalib/plugins/internal.py:171
+#: ipalib/plugins/internal.py:179
 msgid "No entries."
 msgstr ""
 
-#: ipalib/plugins/internal.py:172
+#: ipalib/plugins/internal.py:180
+#, python-brace-format
 msgid "Showing ${start} to ${end} of ${total} entries."
 msgstr ""
 
-#: ipalib/plugins/internal.py:174
+#: ipalib/plugins/internal.py:182
+#, python-brace-format
 msgid "Remove RunAs ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:175
+#: ipalib/plugins/internal.py:183
+#, python-brace-format
 msgid "Remove RunAs Groups from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:176
+#: ipalib/plugins/internal.py:184
+#, python-brace-format
 msgid "Remove ${other_entity} Managing ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:177
+#: ipalib/plugins/internal.py:185
+#, python-brace-format
 msgid "Remove ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:178
+#: ipalib/plugins/internal.py:186
+#, python-brace-format
 msgid "Remove Allow ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:179
+#: ipalib/plugins/internal.py:187
+#, python-brace-format
 msgid "Remove Deny ${other_entity} from ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:180
+#: ipalib/plugins/internal.py:188
+#, python-brace-format
 msgid "Remove ${entity} ${primary_key} from ${other_entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:182
+#: ipalib/plugins/internal.py:190
+#, python-brace-format
 msgid "${count} item(s) removed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:183
+#: ipalib/plugins/internal.py:191
 msgid "Show Results"
 msgstr ""
 
-#: ipalib/plugins/internal.py:186
+#: ipalib/plugins/internal.py:194 ipalib/plugins/internal.py:242
+msgid "About"
+msgstr ""
+
+#: ipalib/plugins/internal.py:195
 msgid "Add"
 msgstr ""
 
-#: ipalib/plugins/internal.py:187
+#: ipalib/plugins/internal.py:196
 msgid "Add and Add Another"
 msgstr ""
 
-#: ipalib/plugins/internal.py:188
+#: ipalib/plugins/internal.py:197
 msgid "Add and Close"
 msgstr ""
 
-#: ipalib/plugins/internal.py:189
+#: ipalib/plugins/internal.py:198
 msgid "Add and Edit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:190
+#: ipalib/plugins/internal.py:199
 msgid "Add Many"
 msgstr ""
 
-#: ipalib/plugins/internal.py:191
+#: ipalib/plugins/internal.py:200
 msgid "Back"
 msgstr ""
 
-#: ipalib/plugins/internal.py:192
+#: ipalib/plugins/internal.py:201
 msgid "Cancel"
 msgstr ""
 
-#: ipalib/plugins/internal.py:193
+#: ipalib/plugins/internal.py:202
 msgid "Close"
 msgstr ""
 
-#: ipalib/plugins/internal.py:194 ipalib/plugins/internal.py:655
+#: ipalib/plugins/internal.py:203 ipalib/plugins/internal.py:683
 msgid "Disable"
 msgstr ""
 
-#: ipalib/plugins/internal.py:195
+#: ipalib/plugins/internal.py:204
 msgid "Edit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:196 ipalib/plugins/internal.py:657
+#: ipalib/plugins/internal.py:205 ipalib/plugins/internal.py:685
 msgid "Enable"
 msgstr ""
 
-#: ipalib/plugins/internal.py:197
+#: ipalib/plugins/internal.py:207
 msgid "Find"
 msgstr ""
 
-#: ipalib/plugins/internal.py:198
+#: ipalib/plugins/internal.py:208
 msgid "Get"
 msgstr ""
 
-#: ipalib/plugins/internal.py:199
+#: ipalib/plugins/internal.py:209
 msgid "Issue"
 msgstr ""
 
-#: ipalib/plugins/internal.py:200
+#: ipalib/plugins/internal.py:210
 msgid "OK"
 msgstr ""
 
-#: ipalib/plugins/internal.py:201
+#: ipalib/plugins/internal.py:211
 msgid "Refresh"
 msgstr ""
 
-#: ipalib/plugins/internal.py:202
+#: ipalib/plugins/internal.py:212
 msgid "Delete"
 msgstr ""
 
-#: ipalib/plugins/internal.py:203
+#: ipalib/plugins/internal.py:213
 msgid "Reset"
 msgstr ""
 
-#: ipalib/plugins/internal.py:204
+#: ipalib/plugins/internal.py:214
 msgid "Reset Password and Login"
 msgstr ""
 
-#: ipalib/plugins/internal.py:205
+#: ipalib/plugins/internal.py:215
 msgid "Restore"
 msgstr ""
 
-#: ipalib/plugins/internal.py:206
+#: ipalib/plugins/internal.py:216
 msgid "Retry"
 msgstr ""
 
-#: ipalib/plugins/internal.py:207
+#: ipalib/plugins/internal.py:217
 msgid "Revoke"
 msgstr ""
 
-#: ipalib/plugins/internal.py:208
+#: ipalib/plugins/internal.py:218
 msgid "Set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:209
+#: ipalib/plugins/internal.py:219
 msgid "Update"
 msgstr ""
 
-#: ipalib/plugins/internal.py:210
+#: ipalib/plugins/internal.py:220
 msgid "View"
 msgstr ""
 
-#: ipalib/plugins/internal.py:213
+#: ipalib/plugins/internal.py:223
 msgid "Collapse All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:214
+#: ipalib/plugins/internal.py:224
 msgid "Expand All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:215
+#: ipalib/plugins/internal.py:225
 msgid "General"
 msgstr ""
 
-#: ipalib/plugins/internal.py:216
+#: ipalib/plugins/internal.py:226
 msgid "Identity Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:217
+#: ipalib/plugins/internal.py:227
+#, python-brace-format
 msgid "${entity} ${primary_key} Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:218
+#: ipalib/plugins/internal.py:228
 msgid "Back to Top"
 msgstr ""
 
-#: ipalib/plugins/internal.py:219
+#: ipalib/plugins/internal.py:229
+#, python-brace-format
 msgid "${entity} ${primary_key} updated"
 msgstr ""
 
-#: ipalib/plugins/internal.py:222
+#: ipalib/plugins/internal.py:232
+#, python-brace-format
 msgid "${entity} successfully added"
 msgstr ""
 
-#: ipalib/plugins/internal.py:223
+#: ipalib/plugins/internal.py:233
+#, python-brace-format
 msgid "Add ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:224
+#: ipalib/plugins/internal.py:234
 msgid "Available"
 msgstr ""
 
-#: ipalib/plugins/internal.py:225
+#: ipalib/plugins/internal.py:235
 msgid "Some operations failed."
 msgstr ""
 
-#: ipalib/plugins/internal.py:226
+#: ipalib/plugins/internal.py:236
 msgid "Operations Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:227
+#: ipalib/plugins/internal.py:237
 msgid "Confirmation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:228
+#: ipalib/plugins/internal.py:238
 msgid "This page has unsaved changes. Please save or revert."
 msgstr ""
 
-#: ipalib/plugins/internal.py:229
+#: ipalib/plugins/internal.py:239
 msgid "Unsaved Changes"
 msgstr ""
 
-#: ipalib/plugins/internal.py:230
+#: ipalib/plugins/internal.py:240
+#, python-brace-format
 msgid "Edit ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:231
+#: ipalib/plugins/internal.py:241
 msgid "Hide details"
 msgstr ""
 
-#: ipalib/plugins/internal.py:232
+#: ipalib/plugins/internal.py:243
+#, python-brace-format
+msgid "${product}, version: ${version}"
+msgstr ""
+
+#: ipalib/plugins/internal.py:244
 msgid "Prospective"
 msgstr ""
 
-#: ipalib/plugins/internal.py:233
+#: ipalib/plugins/internal.py:245
 msgid "Redirection"
 msgstr ""
 
-#: ipalib/plugins/internal.py:234
+#: ipalib/plugins/internal.py:246
 msgid "Select entries to be removed."
 msgstr ""
 
-#: ipalib/plugins/internal.py:235
+#: ipalib/plugins/internal.py:247
+#, python-brace-format
 msgid "Remove ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:236
+#: ipalib/plugins/internal.py:248
 msgid "Show details"
 msgstr ""
 
-#: ipalib/plugins/internal.py:237
+#: ipalib/plugins/internal.py:249
 msgid "Validation error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:238
+#: ipalib/plugins/internal.py:250
 msgid "Input form contains invalid or missing values."
 msgstr ""
 
-#: ipalib/plugins/internal.py:241
+#: ipalib/plugins/internal.py:253
 msgid "Please try the following options:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:242
+#: ipalib/plugins/internal.py:254
 msgid "If the problem persists please contact the system administrator."
 msgstr ""
 
-#: ipalib/plugins/internal.py:243
+#: ipalib/plugins/internal.py:255
 msgid "Refresh the page."
 msgstr ""
 
-#: ipalib/plugins/internal.py:244
+#: ipalib/plugins/internal.py:256
 msgid "Reload the browser."
 msgstr ""
 
-#: ipalib/plugins/internal.py:245
+#: ipalib/plugins/internal.py:257
 msgid "Return to the main page and retry the operation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:246
+#: ipalib/plugins/internal.py:258
+#, python-brace-format
 msgid "An error has occurred (${error})"
 msgstr ""
 
-#: ipalib/plugins/internal.py:250
+#: ipalib/plugins/internal.py:262
 msgid "HTTP Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:251
+#: ipalib/plugins/internal.py:263
 msgid "Internal Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:252
+#: ipalib/plugins/internal.py:264
 msgid "IPA Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:253
+#: ipalib/plugins/internal.py:265
 msgid "No response"
 msgstr ""
 
-#: ipalib/plugins/internal.py:254
+#: ipalib/plugins/internal.py:266
 msgid "Unknown Error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:255
+#: ipalib/plugins/internal.py:267
 msgid "URL"
 msgstr ""
 
-#: ipalib/plugins/internal.py:258
+#: ipalib/plugins/internal.py:270
+#, python-brace-format
 msgid "${primary_key} is managed by:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:259
+#: ipalib/plugins/internal.py:271
+#, python-brace-format
 msgid "${primary_key} members:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:260
+#: ipalib/plugins/internal.py:272
+#, python-brace-format
 msgid "${primary_key} is a member of:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:263
+#: ipalib/plugins/internal.py:275
 msgid "Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:264
+#: ipalib/plugins/internal.py:276 ipalib/plugins/internal.py:676
 msgid "Search"
 msgstr ""
 
-#: ipalib/plugins/internal.py:266
+#: ipalib/plugins/internal.py:278
 msgid "False"
 msgstr ""
 
-#: ipalib/plugins/internal.py:268
+#: ipalib/plugins/internal.py:280
 msgid "Inherited from server configuration"
 msgstr ""
 
-#: ipalib/plugins/internal.py:269
+#: ipalib/plugins/internal.py:281
 msgid "MS-PAC"
 msgstr ""
 
-#: ipalib/plugins/internal.py:270
+#: ipalib/plugins/internal.py:282
 msgid "Override inherited settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:271
+#: ipalib/plugins/internal.py:283
 msgid "PAD"
 msgstr ""
 
-#: ipalib/plugins/internal.py:274
+#: ipalib/plugins/internal.py:286
 msgid ""
 "To login with username and password, enter them in the fields below then "
 "click Login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:275
+#: ipalib/plugins/internal.py:287
 msgid "Logged In As"
 msgstr ""
 
-#: ipalib/plugins/internal.py:276
+#: ipalib/plugins/internal.py:288
+#, python-brace-format
 msgid ""
 "To login with Kerberos, please make sure you have valid tickets (obtainable "
 "via kinit) and <a href='http://${host}/ipa/config/unauthorized."
 "html'>configured</a> the browser correctly, then click Login."
 msgstr ""
 
-#: ipalib/plugins/internal.py:277
+#: ipalib/plugins/internal.py:289
 msgid "Login"
 msgstr ""
 
-#: ipalib/plugins/internal.py:278
+#: ipalib/plugins/internal.py:290
 msgid "Logout"
 msgstr ""
 
-#: ipalib/plugins/internal.py:279
+#: ipalib/plugins/internal.py:291
 msgid "Logout error"
 msgstr ""
 
-#: ipalib/plugins/internal.py:281
+#: ipalib/plugins/internal.py:293
 msgid "Username"
 msgstr ""
 
-#: ipalib/plugins/internal.py:284
+#: ipalib/plugins/internal.py:296
 msgid "number of passwords"
 msgstr ""
 
-#: ipalib/plugins/internal.py:285
+#: ipalib/plugins/internal.py:297
 msgid "seconds"
 msgstr ""
 
-#: ipalib/plugins/internal.py:289 ipalib/plugins/internal.py:294
+#: ipalib/plugins/internal.py:301 ipalib/plugins/internal.py:306
 msgid "Attribute"
 msgstr ""
 
-#: ipalib/plugins/internal.py:292
+#: ipalib/plugins/internal.py:304
+#, python-brace-format
 msgid "Add Condition into ${pkey}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:293
+#: ipalib/plugins/internal.py:305
 msgid "Add Rule"
 msgstr ""
 
-#: ipalib/plugins/internal.py:295
+#: ipalib/plugins/internal.py:307
 msgid "Default host group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:296
+#: ipalib/plugins/internal.py:308
 msgid "Default user group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:297
+#: ipalib/plugins/internal.py:309
 msgid "Exclusive"
 msgstr ""
 
-#: ipalib/plugins/internal.py:298
+#: ipalib/plugins/internal.py:310
 msgid "Expression"
 msgstr ""
 
-#: ipalib/plugins/internal.py:299
+#: ipalib/plugins/internal.py:311
 msgid "Host group rule"
 msgstr ""
 
-#: ipalib/plugins/internal.py:300
+#: ipalib/plugins/internal.py:312
 msgid "Host group rules"
 msgstr ""
 
-#: ipalib/plugins/internal.py:301
+#: ipalib/plugins/internal.py:313
 msgid "Inclusive"
 msgstr ""
 
-#: ipalib/plugins/internal.py:302
+#: ipalib/plugins/internal.py:314
 msgid "User group rule"
 msgstr ""
 
-#: ipalib/plugins/internal.py:303
+#: ipalib/plugins/internal.py:315
 msgid "User group rules"
 msgstr ""
 
-#: ipalib/plugins/internal.py:308
+#: ipalib/plugins/internal.py:320
 msgid "Automount Location Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:311
+#: ipalib/plugins/internal.py:323
 msgid "Map Type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:312
+#: ipalib/plugins/internal.py:324
 msgid "Direct"
 msgstr ""
 
-#: ipalib/plugins/internal.py:313
+#: ipalib/plugins/internal.py:325
 msgid "Indirect"
 msgstr ""
 
-#: ipalib/plugins/internal.py:316
+#: ipalib/plugins/internal.py:328
 msgid "AA Compromise"
 msgstr ""
 
-#: ipalib/plugins/internal.py:317
+#: ipalib/plugins/internal.py:329
 msgid "Affiliation Changed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:318
+#: ipalib/plugins/internal.py:330
 msgid "CA Compromise"
 msgstr ""
 
-#: ipalib/plugins/internal.py:320 ipalib/plugins/internal.py:665
+#: ipalib/plugins/internal.py:332 ipalib/plugins/internal.py:694
 msgid "Certificates"
 msgstr ""
 
-#: ipalib/plugins/internal.py:321
+#: ipalib/plugins/internal.py:333
 msgid "Certificate Hold"
 msgstr ""
 
-#: ipalib/plugins/internal.py:322
+#: ipalib/plugins/internal.py:334
 msgid "Cessation of Operation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:323
+#: ipalib/plugins/internal.py:335
 msgid "Common Name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:324
+#: ipalib/plugins/internal.py:336
 msgid "Expires On"
 msgstr ""
 
-#: ipalib/plugins/internal.py:325
+#: ipalib/plugins/internal.py:337
 msgid "Issued on from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:326
+#: ipalib/plugins/internal.py:338
 msgid "Issued on to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:327
+#: ipalib/plugins/internal.py:339
 msgid "Maximum serial number"
 msgstr ""
 
-#: ipalib/plugins/internal.py:328
+#: ipalib/plugins/internal.py:340
 msgid "Minimum serial number"
 msgstr ""
 
-#: ipalib/plugins/internal.py:330
+#: ipalib/plugins/internal.py:342
 msgid "Revoked on from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:331
+#: ipalib/plugins/internal.py:343
 msgid "Revoked on to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:333
+#: ipalib/plugins/internal.py:345
 msgid "Valid not after from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:334
+#: ipalib/plugins/internal.py:346
 msgid "Valid not after to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:335
+#: ipalib/plugins/internal.py:347
 msgid "Valid not before from"
 msgstr ""
 
-#: ipalib/plugins/internal.py:336
+#: ipalib/plugins/internal.py:348
 msgid "Valid not before to"
 msgstr ""
 
-#: ipalib/plugins/internal.py:337
+#: ipalib/plugins/internal.py:349
 msgid "Fingerprints"
 msgstr ""
 
-#: ipalib/plugins/internal.py:338
+#: ipalib/plugins/internal.py:350
+msgid "Get Certificate"
+msgstr ""
+
+#: ipalib/plugins/internal.py:351
+#, python-brace-format
 msgid "Issue New Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:339
+#: ipalib/plugins/internal.py:352
 msgid "Issued By"
 msgstr ""
 
-#: ipalib/plugins/internal.py:340
+#: ipalib/plugins/internal.py:353
 msgid "Issued On"
 msgstr ""
 
-#: ipalib/plugins/internal.py:341
+#: ipalib/plugins/internal.py:354
 msgid "Issued To"
 msgstr ""
 
-#: ipalib/plugins/internal.py:342
+#: ipalib/plugins/internal.py:355
 msgid "Key Compromise"
 msgstr ""
 
-#: ipalib/plugins/internal.py:343
+#: ipalib/plugins/internal.py:356
 msgid "MD5 Fingerprint"
 msgstr ""
 
-#: ipalib/plugins/internal.py:344
+#: ipalib/plugins/internal.py:357
 msgid "No Valid Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:345
+#: ipalib/plugins/internal.py:358
 msgid "New Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:346
+#: ipalib/plugins/internal.py:359
 msgid "Note"
 msgstr ""
 
-#: ipalib/plugins/internal.py:347
+#: ipalib/plugins/internal.py:360
 msgid "Organization"
 msgstr ""
 
-#: ipalib/plugins/internal.py:348
+#: ipalib/plugins/internal.py:361
 msgid "Organizational Unit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:349
+#: ipalib/plugins/internal.py:362
 msgid "Privilege Withdrawn"
 msgstr ""
 
-#: ipalib/plugins/internal.py:350
+#: ipalib/plugins/internal.py:363
 msgid "Reason for Revocation"
 msgstr ""
 
-#: ipalib/plugins/internal.py:351
+#: ipalib/plugins/internal.py:364
 msgid "Remove from CRL"
 msgstr ""
 
-#: ipalib/plugins/internal.py:352
+#: ipalib/plugins/internal.py:365
+#, python-brace-format
 msgid ""
 "<ol> <li>Create a certificate database or use an existing one. To create a "
 "new database:<br/> <code># certutil -N -d &lt;database path&gt;</code> </li> "
@@ -6123,919 +6529,990 @@ msgid ""
 "NEW CERTIFICATE REQUEST-----</em>) into the text area below: </li> </ol>"
 msgstr ""
 
-#: ipalib/plugins/internal.py:353
+#: ipalib/plugins/internal.py:366
 msgid "Certificate requested"
 msgstr ""
 
-#: ipalib/plugins/internal.py:354
+#: ipalib/plugins/internal.py:367
+#, python-brace-format
 msgid "Restore Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:355
+#: ipalib/plugins/internal.py:368
 msgid "Restore Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:356
+#: ipalib/plugins/internal.py:369
 msgid ""
 "To confirm your intention to restore this certificate, click the \"Restore\" "
 "button."
 msgstr ""
 
-#: ipalib/plugins/internal.py:357
+#: ipalib/plugins/internal.py:370
 msgid "Certificate restored"
 msgstr ""
 
-#: ipalib/plugins/internal.py:359
+#: ipalib/plugins/internal.py:372
+#, python-brace-format
 msgid "Revoke Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:360
+#: ipalib/plugins/internal.py:373
 msgid "Revoke Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:361
+#: ipalib/plugins/internal.py:374
 msgid ""
 "To confirm your intention to revoke this certificate, select a reason from "
 "the pull-down list, and click the \"Revoke\" button."
 msgstr ""
 
-#: ipalib/plugins/internal.py:362
+#: ipalib/plugins/internal.py:375
 msgid "Certificate Revoked"
 msgstr ""
 
-#: ipalib/plugins/internal.py:365
+#: ipalib/plugins/internal.py:378
 msgid "SHA1 Fingerprint"
 msgstr ""
 
-#: ipalib/plugins/internal.py:367
+#: ipalib/plugins/internal.py:380
 msgid "Superseded"
 msgstr ""
 
-#: ipalib/plugins/internal.py:368
+#: ipalib/plugins/internal.py:381
 msgid "Unspecified"
 msgstr ""
 
-#: ipalib/plugins/internal.py:369
+#: ipalib/plugins/internal.py:382
 msgid "Valid Certificate Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:370
+#: ipalib/plugins/internal.py:383
 msgid "Validity"
 msgstr ""
 
-#: ipalib/plugins/internal.py:371
+#: ipalib/plugins/internal.py:384
+#, python-brace-format
 msgid "Certificate for ${entity} ${primary_key}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:374
+#: ipalib/plugins/internal.py:385
+msgid "View Certificate"
+msgstr ""
+
+#: ipalib/plugins/internal.py:388
 msgid "Group Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:375
+#: ipalib/plugins/internal.py:389
 msgid "Search Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:376
+#: ipalib/plugins/internal.py:390
 msgid "SELinux Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:377
+#: ipalib/plugins/internal.py:391
 msgid "Service Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:378
+#: ipalib/plugins/internal.py:392
 msgid "User Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:383
+#: ipalib/plugins/internal.py:397
 msgid "Forward first"
 msgstr ""
 
-#: ipalib/plugins/internal.py:384
+#: ipalib/plugins/internal.py:398
 msgid "Forwarding disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:385
+#: ipalib/plugins/internal.py:399
 msgid "Forward only"
 msgstr ""
 
-#: ipalib/plugins/internal.py:386 ipalib/plugins/internal.py:588
-#: ipalib/plugins/internal.py:611
+#: ipalib/plugins/internal.py:400 ipalib/plugins/internal.py:611
+#: ipalib/plugins/internal.py:635
 msgid "Options"
 msgstr ""
 
-#: ipalib/plugins/internal.py:389
+#: ipalib/plugins/internal.py:403
 msgid "Data"
 msgstr ""
 
-#: ipalib/plugins/internal.py:390
+#: ipalib/plugins/internal.py:404
 msgid "DNS record was deleted because it contained no data."
 msgstr ""
 
-#: ipalib/plugins/internal.py:391
+#: ipalib/plugins/internal.py:405
 msgid "Other Record Types"
 msgstr ""
 
-#: ipalib/plugins/internal.py:392
+#: ipalib/plugins/internal.py:406
 msgid "Address not valid, can't redirect"
 msgstr ""
 
-#: ipalib/plugins/internal.py:393
+#: ipalib/plugins/internal.py:407
 msgid "Create dns record"
 msgstr ""
 
-#: ipalib/plugins/internal.py:394
+#: ipalib/plugins/internal.py:408
 msgid "Creating record."
 msgstr ""
 
-#: ipalib/plugins/internal.py:395
+#: ipalib/plugins/internal.py:409
 msgid "Record creation failed."
 msgstr ""
 
-#: ipalib/plugins/internal.py:396
+#: ipalib/plugins/internal.py:410
 msgid "Checking if record exists."
 msgstr ""
 
-#: ipalib/plugins/internal.py:397
+#: ipalib/plugins/internal.py:411
 msgid "Record not found."
 msgstr ""
 
-#: ipalib/plugins/internal.py:398
+#: ipalib/plugins/internal.py:412
 msgid "Redirection to PTR record"
 msgstr ""
 
-#: ipalib/plugins/internal.py:399
+#: ipalib/plugins/internal.py:413
+#, python-brace-format
 msgid "Zone found: ${zone}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:400
+#: ipalib/plugins/internal.py:414
 msgid "Target reverse zone not found."
 msgstr ""
 
-#: ipalib/plugins/internal.py:401
+#: ipalib/plugins/internal.py:415
 msgid "Fetching DNS zones."
 msgstr ""
 
-#: ipalib/plugins/internal.py:402
+#: ipalib/plugins/internal.py:416
 msgid "An error occurred while fetching dns zones."
 msgstr ""
 
-#: ipalib/plugins/internal.py:403
+#: ipalib/plugins/internal.py:417
 msgid "You will be redirected to DNS Zone."
 msgstr ""
 
-#: ipalib/plugins/internal.py:404
+#: ipalib/plugins/internal.py:418
 msgid "Standard Record Types"
 msgstr ""
 
-#: ipalib/plugins/internal.py:405
+#: ipalib/plugins/internal.py:419
 msgid "Records for DNS Zone"
 msgstr ""
 
-#: ipalib/plugins/internal.py:406
+#: ipalib/plugins/internal.py:420
 msgid "Record Type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:409
+#: ipalib/plugins/internal.py:423
 msgid "DNS Zone Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:410
+#: ipalib/plugins/internal.py:424
 msgid "Add Permission"
 msgstr ""
 
-#: ipalib/plugins/internal.py:411
+#: ipalib/plugins/internal.py:425
+#, python-brace-format
+msgid "Are you sure you want to add permission for DNS Zone ${object}?"
+msgstr ""
+
+#: ipalib/plugins/internal.py:426
 msgid "Remove Permission"
 msgstr ""
 
-#: ipalib/plugins/internal.py:414
+#: ipalib/plugins/internal.py:427
+#, python-brace-format
+msgid "Are you sure you want to remove permission for DNS Zone ${object}?"
+msgstr ""
+
+#: ipalib/plugins/internal.py:430
 msgid "Group Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:415 ipalib/plugins/internal.py:487
-#: ipalib/plugins/internal.py:583
+#: ipalib/plugins/internal.py:431 ipalib/plugins/internal.py:503
+#: ipalib/plugins/internal.py:606
 msgid "External"
 msgstr ""
 
-#: ipalib/plugins/internal.py:416
+#: ipalib/plugins/internal.py:432
 msgid "Change to external group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:417
+#: ipalib/plugins/internal.py:433
 msgid "Change to POSIX group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:418
+#: ipalib/plugins/internal.py:434
 msgid "Normal"
 msgstr ""
 
-#: ipalib/plugins/internal.py:419
+#: ipalib/plugins/internal.py:435
 msgid "POSIX"
 msgstr ""
 
-#: ipalib/plugins/internal.py:420
+#: ipalib/plugins/internal.py:436
 msgid "Group Type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:423 ipalib/plugins/internal.py:485
-#: ipalib/plugins/internal.py:537 ipalib/plugins/internal.py:579
+#: ipalib/plugins/internal.py:439 ipalib/plugins/internal.py:501
+#: ipalib/plugins/internal.py:560 ipalib/plugins/internal.py:602
 msgid "Any Host"
 msgstr ""
 
-#: ipalib/plugins/internal.py:424
+#: ipalib/plugins/internal.py:440
 msgid "Any Service"
 msgstr ""
 
-#: ipalib/plugins/internal.py:425 ipalib/plugins/internal.py:486
-#: ipalib/plugins/internal.py:538 ipalib/plugins/internal.py:580
+#: ipalib/plugins/internal.py:441 ipalib/plugins/internal.py:502
+#: ipalib/plugins/internal.py:561 ipalib/plugins/internal.py:603
 msgid "Anyone"
 msgstr ""
 
-#: ipalib/plugins/internal.py:426
+#: ipalib/plugins/internal.py:442
 msgid "Accessing"
 msgstr ""
 
-#: ipalib/plugins/internal.py:427 ipalib/plugins/internal.py:585
+#: ipalib/plugins/internal.py:443 ipalib/plugins/internal.py:608
 msgid "Rule status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:428
+#: ipalib/plugins/internal.py:444
 msgid "Via Service"
 msgstr ""
 
-#: ipalib/plugins/internal.py:429 ipalib/plugins/internal.py:492
-#: ipalib/plugins/internal.py:540 ipalib/plugins/internal.py:592
+#: ipalib/plugins/internal.py:445 ipalib/plugins/internal.py:508
+#: ipalib/plugins/internal.py:563 ipalib/plugins/internal.py:615
 msgid "Specified Hosts and Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:430
+#: ipalib/plugins/internal.py:446
 msgid "Specified Services and Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:431 ipalib/plugins/internal.py:493
-#: ipalib/plugins/internal.py:541 ipalib/plugins/internal.py:593
+#: ipalib/plugins/internal.py:447 ipalib/plugins/internal.py:509
+#: ipalib/plugins/internal.py:564 ipalib/plugins/internal.py:616
 msgid "Specified Users and Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:432 ipalib/plugins/internal.py:594
+#: ipalib/plugins/internal.py:448 ipalib/plugins/internal.py:617
 msgid "Who"
 msgstr ""
 
-#: ipalib/plugins/internal.py:440
+#: ipalib/plugins/internal.py:456
 msgid "Access Denied"
 msgstr ""
 
-#: ipalib/plugins/internal.py:441
+#: ipalib/plugins/internal.py:457
 msgid "Access Granted"
 msgstr ""
 
-#: ipalib/plugins/internal.py:442
+#: ipalib/plugins/internal.py:458
 msgid "Include Disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:443
+#: ipalib/plugins/internal.py:459
 msgid "Include Enabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:444
+#: ipalib/plugins/internal.py:460
 msgid "HBAC Test"
 msgstr ""
 
-#: ipalib/plugins/internal.py:445
+#: ipalib/plugins/internal.py:461
 msgid "Matched"
 msgstr ""
 
-#: ipalib/plugins/internal.py:446
+#: ipalib/plugins/internal.py:462
 msgid "Missing values: "
 msgstr ""
 
-#: ipalib/plugins/internal.py:447
+#: ipalib/plugins/internal.py:463
 msgid "New Test"
 msgstr ""
 
-#: ipalib/plugins/internal.py:448
+#: ipalib/plugins/internal.py:464
 msgid "Rules"
 msgstr ""
 
-#: ipalib/plugins/internal.py:449
+#: ipalib/plugins/internal.py:465
 msgid "Run Test"
 msgstr ""
 
-#: ipalib/plugins/internal.py:450
+#: ipalib/plugins/internal.py:466
+#, python-brace-format
 msgid "Specify external ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:451
+#: ipalib/plugins/internal.py:467
 msgid "Unmatched"
 msgstr ""
 
-#: ipalib/plugins/internal.py:454
+#: ipalib/plugins/internal.py:470
 msgid "Host Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:455 ipalib/plugins/internal.py:548
+#: ipalib/plugins/internal.py:471 ipalib/plugins/internal.py:571
 msgid "Host Name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:456 ipalib/plugins/internal.py:546
+#: ipalib/plugins/internal.py:472 ipalib/plugins/internal.py:569
 msgid "Delete Key, Unprovision"
 msgstr ""
 
-#: ipalib/plugins/internal.py:457
+#: ipalib/plugins/internal.py:473
 msgid "Host Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:458
+#: ipalib/plugins/internal.py:474
 msgid "Enrolled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:459
+#: ipalib/plugins/internal.py:475
 msgid "Enrollment"
 msgstr ""
 
-#: ipalib/plugins/internal.py:460
+#: ipalib/plugins/internal.py:476
 msgid "Fully Qualified Host Name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:461
+#: ipalib/plugins/internal.py:477
 msgid "Kerberos Key"
 msgstr ""
 
-#: ipalib/plugins/internal.py:462 ipalib/plugins/internal.py:549
+#: ipalib/plugins/internal.py:478 ipalib/plugins/internal.py:572
 msgid "Kerberos Key Not Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:463
+#: ipalib/plugins/internal.py:479
 msgid "Kerberos Key Present, Host Provisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:464
+#: ipalib/plugins/internal.py:480 ipalib/plugins/internal.py:658
 msgid "One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:465
+#: ipalib/plugins/internal.py:481
 msgid "One-Time-Password Not Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:466
+#: ipalib/plugins/internal.py:482
 msgid "One-Time-Password Present"
 msgstr ""
 
-#: ipalib/plugins/internal.py:467
+#: ipalib/plugins/internal.py:483
 msgid "Reset OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:468
+#: ipalib/plugins/internal.py:484
 msgid "Reset One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:469
+#: ipalib/plugins/internal.py:485
 msgid "Set OTP"
 msgstr ""
 
-#: ipalib/plugins/internal.py:470
+#: ipalib/plugins/internal.py:486
 msgid "OTP set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:471
+#: ipalib/plugins/internal.py:487
 msgid "Set One-Time-Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:473 ipalib/plugins/internal.py:553
+#: ipalib/plugins/internal.py:489 ipalib/plugins/internal.py:576
 msgid "Unprovision"
 msgstr ""
 
-#: ipalib/plugins/internal.py:474
+#: ipalib/plugins/internal.py:490
 msgid "Are you sure you want to unprovision this host?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:475 ipalib/plugins/internal.py:555
+#: ipalib/plugins/internal.py:491 ipalib/plugins/internal.py:578
+#, python-brace-format
 msgid "Unprovisioning ${entity}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:476
+#: ipalib/plugins/internal.py:492
 msgid "Host unprovisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:479
+#: ipalib/plugins/internal.py:495
 msgid "Host Group Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:482 ipalib/plugins/krbtpolicy.py:79
-#: ipalib/plugins/krbtpolicy.py:80
+#: ipalib/plugins/internal.py:498 ipalib/plugins/krbtpolicy.py:118
+#: ipalib/plugins/krbtpolicy.py:119
 msgid "Kerberos Ticket Policy"
 msgstr ""
 
-#: ipalib/plugins/internal.py:491
+#: ipalib/plugins/internal.py:507
 msgid "Netgroup Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:494 ipalib/plugins/internal.py:542
-#: ipalib/plugins/pwpolicy.py:444 ipalib/plugins/user.py:226
+#: ipalib/plugins/internal.py:510 ipalib/plugins/internal.py:565
+#: ipalib/plugins/pwpolicy.py:519 ipalib/plugins/user.py:430
 msgid "User"
 msgstr ""
 
-#: ipalib/plugins/internal.py:499 ipalib/plugins/internal.py:668
-msgid "Identity"
+#: ipalib/plugins/internal.py:520
+msgid "Permission settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:500
-msgid "Permission with invalid target specification"
+#: ipalib/plugins/internal.py:521
+msgid "Attribute breakdown"
 msgstr ""
 
-#: ipalib/plugins/internal.py:505
+#: ipalib/plugins/internal.py:525
 msgid "Privilege Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:508 ipalib/plugins/pwpolicy.py:224
+#: ipalib/plugins/internal.py:528 ipalib/plugins/pwpolicy.py:303
 msgid "Password Policy"
 msgstr ""
 
-#: ipalib/plugins/internal.py:511
+#: ipalib/plugins/internal.py:531
 msgid "Range Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:512
+#: ipalib/plugins/internal.py:532
 msgid "Base ID"
 msgstr ""
 
-#: ipalib/plugins/internal.py:513
+#: ipalib/plugins/internal.py:533
 msgid "Primary RID base"
 msgstr ""
 
-#: ipalib/plugins/internal.py:514
+#: ipalib/plugins/internal.py:534
 msgid "Range size"
 msgstr ""
 
-#: ipalib/plugins/internal.py:515
+#: ipalib/plugins/internal.py:535
 msgid "Domain SID"
 msgstr ""
 
-#: ipalib/plugins/internal.py:516
+#: ipalib/plugins/internal.py:536
 msgid "Secondary RID base"
 msgstr ""
 
-#: ipalib/plugins/internal.py:518 ipalib/plugins/trust.py:142
+#: ipalib/plugins/internal.py:538 ipalib/plugins/trust.py:145
 msgid "Active Directory domain"
 msgstr ""
 
-#: ipalib/plugins/internal.py:519
+#: ipalib/plugins/internal.py:539
 msgid "Active Directory domain with POSIX attributes"
 msgstr ""
 
-#: ipalib/plugins/internal.py:520
+#: ipalib/plugins/internal.py:540
 msgid "Detect"
 msgstr ""
 
-#: ipalib/plugins/internal.py:521
+#: ipalib/plugins/internal.py:541
 msgid "Local domain"
 msgstr ""
 
-#: ipalib/plugins/internal.py:522
+#: ipalib/plugins/internal.py:542
 msgid "IPA trust"
 msgstr ""
 
-#: ipalib/plugins/internal.py:523
+#: ipalib/plugins/internal.py:543
 msgid "Active Directory winsync"
 msgstr ""
 
-#: ipalib/plugins/internal.py:526 ipalib/plugins/realmdomains.py:65
-#: ipalib/plugins/realmdomains.py:66
+#: ipalib/plugins/internal.py:546
+msgid "RADIUS Proxy Server Settings"
+msgstr ""
+
+#: ipalib/plugins/internal.py:549 ipalib/plugins/realmdomains.py:84
+#: ipalib/plugins/realmdomains.py:85
 msgid "Realm Domains"
 msgstr ""
 
-#: ipalib/plugins/internal.py:527
+#: ipalib/plugins/internal.py:550
 msgid "Check DNS"
 msgstr ""
 
-#: ipalib/plugins/internal.py:528
+#: ipalib/plugins/internal.py:551
 msgid "Do you also want to perform DNS check?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:529
+#: ipalib/plugins/internal.py:552
 msgid "Force Update"
 msgstr ""
 
-#: ipalib/plugins/internal.py:532
+#: ipalib/plugins/internal.py:555
 msgid "Role Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:545
+#: ipalib/plugins/internal.py:568
 msgid "Service Certificate"
 msgstr ""
 
-#: ipalib/plugins/internal.py:547
+#: ipalib/plugins/internal.py:570
 msgid "Service Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:550
+#: ipalib/plugins/internal.py:573
 msgid "Provisioning"
 msgstr ""
 
-#: ipalib/plugins/internal.py:554
+#: ipalib/plugins/internal.py:577
 msgid "Are you sure you want to unprovision this service?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:556
+#: ipalib/plugins/internal.py:579
 msgid "Service unprovisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:557
+#: ipalib/plugins/internal.py:580
 msgid "Kerberos Key Present, Service Provisioned"
 msgstr ""
 
-#: ipalib/plugins/internal.py:560
+#: ipalib/plugins/internal.py:583
 msgid "SSH public keys"
 msgstr ""
 
-#: ipalib/plugins/internal.py:561
+#: ipalib/plugins/internal.py:584
 msgid "SSH public key:"
 msgstr ""
 
-#: ipalib/plugins/internal.py:562
+#: ipalib/plugins/internal.py:585
 msgid "Set SSH key"
 msgstr ""
 
-#: ipalib/plugins/internal.py:563
+#: ipalib/plugins/internal.py:586
 msgid "Show/Set key"
 msgstr ""
 
-#: ipalib/plugins/internal.py:564
+#: ipalib/plugins/internal.py:587
 msgid "Modified: key not set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:565
+#: ipalib/plugins/internal.py:588
 msgid "Modified"
 msgstr ""
 
-#: ipalib/plugins/internal.py:566
+#: ipalib/plugins/internal.py:589
 msgid "New: key not set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:567
+#: ipalib/plugins/internal.py:590
 msgid "New: key set"
 msgstr ""
 
-#: ipalib/plugins/internal.py:570
+#: ipalib/plugins/internal.py:593
 msgid "Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:573 ipalib/plugins/sudocmdgroup.py:82
+#: ipalib/plugins/internal.py:596 ipalib/plugins/sudocmdgroup.py:126
 msgid "Commands"
 msgstr ""
 
-#: ipalib/plugins/internal.py:576
+#: ipalib/plugins/internal.py:599
 msgid "Allow"
 msgstr ""
 
-#: ipalib/plugins/internal.py:577
+#: ipalib/plugins/internal.py:600
 msgid "Any Command"
 msgstr ""
 
-#: ipalib/plugins/internal.py:578
+#: ipalib/plugins/internal.py:601
 msgid "Any Group"
 msgstr ""
 
-#: ipalib/plugins/internal.py:581
+#: ipalib/plugins/internal.py:604
 msgid "Run Commands"
 msgstr ""
 
-#: ipalib/plugins/internal.py:582
+#: ipalib/plugins/internal.py:605
 msgid "Deny"
 msgstr ""
 
-#: ipalib/plugins/internal.py:584
+#: ipalib/plugins/internal.py:607
 msgid "Access this host"
 msgstr ""
 
-#: ipalib/plugins/internal.py:586
+#: ipalib/plugins/internal.py:609
 msgid "Option added"
 msgstr ""
 
-#: ipalib/plugins/internal.py:587
+#: ipalib/plugins/internal.py:610
+#, python-brace-format
 msgid "${count} option(s) removed"
 msgstr ""
 
-#: ipalib/plugins/internal.py:589
+#: ipalib/plugins/internal.py:612
 msgid "As Whom"
 msgstr ""
 
-#: ipalib/plugins/internal.py:590
+#: ipalib/plugins/internal.py:613
 msgid "Specified Commands and Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:591
+#: ipalib/plugins/internal.py:614
 msgid "Specified Groups"
 msgstr ""
 
-#: ipalib/plugins/internal.py:597
+#: ipalib/plugins/internal.py:620
 msgid "Account"
 msgstr ""
 
-#: ipalib/plugins/internal.py:598
+#: ipalib/plugins/internal.py:621
 msgid "Administrative account"
 msgstr ""
 
-#: ipalib/plugins/internal.py:599
+#: ipalib/plugins/internal.py:622
 msgid "SID blacklists"
 msgstr ""
 
-#: ipalib/plugins/internal.py:600
+#: ipalib/plugins/internal.py:623
 msgid "Trust Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:601 ipalib/plugins/realmdomains.py:73
-#: ipalib/plugins/trust.py:803
+#: ipalib/plugins/internal.py:624 ipalib/plugins/realmdomains.py:92
+#: ipalib/plugins/trust.py:850
 msgid "Domain"
 msgstr ""
 
-#: ipalib/plugins/internal.py:602
+#: ipalib/plugins/internal.py:625
 msgid "Establish using"
 msgstr ""
 
-#: ipalib/plugins/internal.py:603 ipalib/plugins/trust.py:219
-#: ipalib/plugins/trust.py:1119
+#: ipalib/plugins/internal.py:626
+msgid "Fetch domains"
+msgstr ""
+
+#: ipalib/plugins/internal.py:627 ipalib/plugins/trust.py:357
+#: ipalib/plugins/trust.py:1167
 msgid "Domain NetBIOS name"
 msgstr ""
 
-#: ipalib/plugins/internal.py:604 ipalib/plugins/trust.py:223
-#: ipalib/plugins/trust.py:1123
+#: ipalib/plugins/internal.py:628 ipalib/plugins/trust.py:361
+#: ipalib/plugins/trust.py:1171
 msgid "Domain Security Identifier"
 msgstr ""
 
-#: ipalib/plugins/internal.py:605
+#: ipalib/plugins/internal.py:629
 msgid "Pre-shared password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:606 ipalib/plugins/trust.py:134
+#: ipalib/plugins/internal.py:630 ipalib/plugins/trust.py:137
 msgid "Trust direction"
 msgstr ""
 
-#: ipalib/plugins/internal.py:607 ipalib/plugins/trust.py:138
+#: ipalib/plugins/internal.py:631 ipalib/plugins/trust.py:141
 msgid "Trust status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:608 ipalib/plugins/trust.py:136
+#: ipalib/plugins/internal.py:632 ipalib/plugins/trust.py:139
 msgid "Trust type"
 msgstr ""
 
-#: ipalib/plugins/internal.py:614
+#: ipalib/plugins/internal.py:638
 msgid "Account Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:615
+#: ipalib/plugins/internal.py:639
 msgid "Account Status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:616
+#: ipalib/plugins/internal.py:640
 msgid "Contact Settings"
 msgstr ""
 
-#: ipalib/plugins/internal.py:617
+#: ipalib/plugins/internal.py:641
 msgid "Employee Information"
 msgstr ""
 
-#: ipalib/plugins/internal.py:618
+#: ipalib/plugins/internal.py:642
 msgid "Error changing account status"
 msgstr ""
 
-#: ipalib/plugins/internal.py:619
+#: ipalib/plugins/internal.py:643
 msgid "Password expiration"
 msgstr ""
 
-#: ipalib/plugins/internal.py:620
+#: ipalib/plugins/internal.py:644
 msgid "Mailing Address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:621
+#: ipalib/plugins/internal.py:645
 msgid "Misc. Information"
 msgstr ""
 
-#: ipalib/plugins/internal.py:622
+#: ipalib/plugins/internal.py:646
+#, python-brace-format
 msgid ""
 "Are you sure you want to ${action} the user?<br/>The change will take effect "
 "immediately."
 msgstr ""
 
-#: ipalib/plugins/internal.py:623
+#: ipalib/plugins/internal.py:647
+#, python-brace-format
 msgid "Click to ${action}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:627 ipalib/plugins/passwd.py:80
+#: ipalib/plugins/internal.py:651 ipalib/plugins/passwd.py:84
 msgid "Current Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:628
+#: ipalib/plugins/internal.py:652
 msgid "Current password is required"
 msgstr ""
 
-#: ipalib/plugins/internal.py:629
+#: ipalib/plugins/internal.py:653
+#, python-brace-format
 msgid "Your password expires in ${days} days."
 msgstr ""
 
-#: ipalib/plugins/internal.py:630
+#: ipalib/plugins/internal.py:654
 msgid "The password or username you entered is incorrect."
 msgstr ""
 
-#: ipalib/plugins/internal.py:631 ipalib/plugins/passwd.py:77
+#: ipalib/plugins/internal.py:655 ipalib/plugins/passwd.py:81
 msgid "New Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:632
+#: ipalib/plugins/internal.py:656
 msgid "New password is required"
 msgstr ""
 
-#: ipalib/plugins/internal.py:634
+#: ipalib/plugins/internal.py:657 ipalib/plugins/passwd.py:94
+msgid "OTP"
+msgstr ""
+
+#: ipalib/plugins/internal.py:660
+msgid "Password or Password+One-Time-Password"
+msgstr ""
+
+#: ipalib/plugins/internal.py:661
 msgid "Password change complete"
 msgstr ""
 
-#: ipalib/plugins/internal.py:635
+#: ipalib/plugins/internal.py:662
 msgid "Passwords must match"
 msgstr ""
 
-#: ipalib/plugins/internal.py:636
+#: ipalib/plugins/internal.py:663
 msgid "Password reset was not successful."
 msgstr ""
 
-#: ipalib/plugins/internal.py:637
+#: ipalib/plugins/internal.py:664
 msgid "Reset Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:638
+#: ipalib/plugins/internal.py:665
 msgid "Reset your password."
 msgstr ""
 
-#: ipalib/plugins/internal.py:639
+#: ipalib/plugins/internal.py:666
 msgid "Verify Password"
 msgstr ""
 
-#: ipalib/plugins/internal.py:642
+#: ipalib/plugins/internal.py:669
 msgid "Are you sure you want to delete selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:643
+#: ipalib/plugins/internal.py:670
+#, python-brace-format
 msgid "${count} item(s) deleted"
 msgstr ""
 
-#: ipalib/plugins/internal.py:644
+#: ipalib/plugins/internal.py:671
 msgid "Are you sure you want to disable selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:645
+#: ipalib/plugins/internal.py:672
+#, python-brace-format
 msgid "${count} item(s) disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:646
+#: ipalib/plugins/internal.py:673
 msgid "Are you sure you want to enable selected entries?"
 msgstr ""
 
-#: ipalib/plugins/internal.py:647
+#: ipalib/plugins/internal.py:674
+#, python-brace-format
 msgid "${count} item(s) enabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:648
+#: ipalib/plugins/internal.py:675
 msgid "Some entries were not deleted"
 msgstr ""
 
-#: ipalib/plugins/internal.py:649
+#: ipalib/plugins/internal.py:677
 msgid "Quick Links"
 msgstr ""
 
-#: ipalib/plugins/internal.py:650
+#: ipalib/plugins/internal.py:678
 msgid "Select All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:651
+#: ipalib/plugins/internal.py:679
+#, python-brace-format
 msgid ""
 "Query returned more results than the configured size limit. Displaying the "
 "first ${counter} results."
 msgstr ""
 
-#: ipalib/plugins/internal.py:652
+#: ipalib/plugins/internal.py:680
 msgid "Unselect All"
 msgstr ""
 
-#: ipalib/plugins/internal.py:656
+#: ipalib/plugins/internal.py:684
 msgid "Disabled"
 msgstr ""
 
-#: ipalib/plugins/internal.py:662
-msgid "Audit"
+#: ipalib/plugins/internal.py:688
+msgid "Working"
 msgstr ""
 
-#: ipalib/plugins/internal.py:663
-msgid "Automember"
+#: ipalib/plugins/internal.py:691
+msgid "Audit"
 msgstr ""
 
-#: ipalib/plugins/internal.py:664
+#: ipalib/plugins/internal.py:693
 msgid "Automount"
 msgstr ""
 
-#: ipalib/plugins/internal.py:666
+#: ipalib/plugins/internal.py:695
 msgid "DNS"
 msgstr ""
 
-#: ipalib/plugins/internal.py:667
+#: ipalib/plugins/internal.py:696
 msgid "Host Based Access Control"
 msgstr ""
 
-#: ipalib/plugins/internal.py:669
+#: ipalib/plugins/internal.py:697
+msgid "Identity"
+msgstr ""
+
+#: ipalib/plugins/internal.py:698
 msgid "IPA Server"
 msgstr ""
 
-#: ipalib/plugins/internal.py:670
+#: ipalib/plugins/internal.py:699
 msgid "Policy"
 msgstr ""
 
-#: ipalib/plugins/internal.py:671
+#: ipalib/plugins/internal.py:700
 msgid "Role Based Access Control"
 msgstr ""
 
-#: ipalib/plugins/internal.py:672
+#: ipalib/plugins/internal.py:701
 msgid "Sudo"
 msgstr ""
 
-#: ipalib/plugins/internal.py:673 ipalib/plugins/trust.py:208
+#: ipalib/plugins/internal.py:702 ipalib/plugins/trust.py:346
 msgid "Trusts"
 msgstr ""
 
-#: ipalib/plugins/internal.py:675
+#: ipalib/plugins/internal.py:704
 msgid "True"
 msgstr ""
 
-#: ipalib/plugins/internal.py:677
+#: ipalib/plugins/internal.py:706
+msgid "First"
+msgstr ""
+
+#: ipalib/plugins/internal.py:707
+msgid "Last"
+msgstr ""
+
+#: ipalib/plugins/internal.py:708
 msgid "Next"
 msgstr ""
 
-#: ipalib/plugins/internal.py:678
+#: ipalib/plugins/internal.py:709
 msgid "Page"
 msgstr ""
 
-#: ipalib/plugins/internal.py:679
+#: ipalib/plugins/internal.py:710
 msgid "Prev"
 msgstr ""
 
-#: ipalib/plugins/internal.py:680
+#: ipalib/plugins/internal.py:711
 msgid "undo"
 msgstr ""
 
-#: ipalib/plugins/internal.py:681
+#: ipalib/plugins/internal.py:712
 msgid "undo all"
 msgstr ""
 
-#: ipalib/plugins/internal.py:683
+#: ipalib/plugins/internal.py:714
 msgid "Text does not match field pattern"
 msgstr ""
 
-#: ipalib/plugins/internal.py:684
+#: ipalib/plugins/internal.py:715
+msgid "Must be an UTC date/time value (e.g., \"2014-01-20 17:58:01Z\")"
+msgstr ""
+
+#: ipalib/plugins/internal.py:716
 msgid "Must be a decimal number"
 msgstr ""
 
-#: ipalib/plugins/internal.py:685
+#: ipalib/plugins/internal.py:717
+msgid "Format error"
+msgstr ""
+
+#: ipalib/plugins/internal.py:718
 msgid "Must be an integer"
 msgstr ""
 
-#: ipalib/plugins/internal.py:686
+#: ipalib/plugins/internal.py:719
 msgid "Not a valid IP address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:687
+#: ipalib/plugins/internal.py:720
 msgid "Not a valid IPv4 address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:688
+#: ipalib/plugins/internal.py:721
 msgid "Not a valid IPv6 address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:689
+#: ipalib/plugins/internal.py:722
+#, python-brace-format
 msgid "Maximum value is ${value}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:690
+#: ipalib/plugins/internal.py:723
+#, python-brace-format
 msgid "Minimum value is ${value}"
 msgstr ""
 
-#: ipalib/plugins/internal.py:691
+#: ipalib/plugins/internal.py:724
 msgid "Not a valid network address"
 msgstr ""
 
-#: ipalib/plugins/internal.py:692
+#: ipalib/plugins/internal.py:725
+msgid "Parse error"
+msgstr ""
+
+#: ipalib/plugins/internal.py:726
+#, python-brace-format
 msgid "'${port}' is not a valid port"
 msgstr ""
 
-#: ipalib/plugins/internal.py:693
+#: ipalib/plugins/internal.py:727
 msgid "Required field"
 msgstr ""
 
-#: ipalib/plugins/internal.py:694
+#: ipalib/plugins/internal.py:728
 msgid "Unsupported value"
 msgstr ""
 
-#: ipalib/plugins/internal.py:699
+#: ipalib/plugins/internal.py:733
 msgid "Dict of I18N messages"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:25
+#: ipalib/plugins/krbtpolicy.py:27
 msgid ""
 "\n"
 "Kerberos ticket policy\n"
@@ -7075,43 +7552,52 @@ msgid ""
 "  ipa krbtpolicy-mod admin --maxlife=3600\n"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:75
+#: ipalib/plugins/krbtpolicy.py:80
 msgid "kerberos ticket policy settings"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:86
+#: ipalib/plugins/krbtpolicy.py:125
 msgid "Manage ticket policy for specific user"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:91
+#: ipalib/plugins/krbtpolicy.py:130
 msgid "Max life"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:92
+#: ipalib/plugins/krbtpolicy.py:131
 msgid "Maximum ticket life (seconds)"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:97
+#: ipalib/plugins/krbtpolicy.py:136
 msgid "Max renew"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:98
+#: ipalib/plugins/krbtpolicy.py:137
 msgid "Maximum renewable age (seconds)"
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:112
+#: ipalib/plugins/krbtpolicy.py:150
 msgid "Modify Kerberos ticket policy."
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:126
+#: ipalib/plugins/krbtpolicy.py:163
 msgid "Display the current Kerberos ticket policy."
 msgstr ""
 
-#: ipalib/plugins/krbtpolicy.py:151
+#: ipalib/plugins/krbtpolicy.py:186
+#, python-format
+msgid "Ticket policy for %s could not be read"
+msgstr ""
+
+#: ipalib/plugins/krbtpolicy.py:199
+msgid "Default ticket policy could not be read"
+msgstr ""
+
+#: ipalib/plugins/krbtpolicy.py:205
 msgid "Reset Kerberos ticket policy to the default values."
 msgstr ""
 
-#: ipalib/plugins/migration.py:35
+#: ipalib/plugins/migration.py:38
 msgid ""
 "\n"
 "Migration to IPA\n"
@@ -7209,210 +7695,218 @@ msgid ""
 "updated.\n"
 msgstr ""
 
-#: ipalib/plugins/migration.py:130
+#: ipalib/plugins/migration.py:135
 #, python-format
 msgid ""
 "Kerberos principal %s already exists. Use 'ipa user-mod' to set it manually."
 msgstr ""
 
-#: ipalib/plugins/migration.py:131
+#: ipalib/plugins/migration.py:136
 #, python-format
 msgid ""
 "Unable to determine if Kerberos principal %s already exists. Use 'ipa user-"
 "mod' to set it manually."
 msgstr ""
 
-#: ipalib/plugins/migration.py:132
+#: ipalib/plugins/migration.py:137
 msgid ""
 "Failed to add user to the default group. Use 'ipa group-add-member' to add "
 "manually."
 msgstr ""
 
-#: ipalib/plugins/migration.py:133
+#: ipalib/plugins/migration.py:138
 msgid "Migration of LDAP search reference is not supported."
 msgstr ""
 
-#: ipalib/plugins/migration.py:134
+#: ipalib/plugins/migration.py:139
 msgid "Malformed DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:151
+#: ipalib/plugins/migration.py:156
 #, python-format
 msgid "%(user)s is not a POSIX user"
 msgstr ""
 
-#: ipalib/plugins/migration.py:419
+#: ipalib/plugins/migration.py:429
 msgid ""
 ". Check GID of the existing group. Use --group-overwrite-gid option to "
 "overwrite the GID"
 msgstr ""
 
-#: ipalib/plugins/migration.py:434
+#: ipalib/plugins/migration.py:444
 msgid "Invalid LDAP URI."
 msgstr ""
 
-#: ipalib/plugins/migration.py:439
+#: ipalib/plugins/migration.py:450
 msgid "Migrate users and groups from DS to IPA."
 msgstr ""
 
-#: ipalib/plugins/migration.py:486
+#: ipalib/plugins/migration.py:497
 msgid "LDAP URI"
 msgstr ""
 
-#: ipalib/plugins/migration.py:487
+#: ipalib/plugins/migration.py:498
 msgid "LDAP URI of DS server to migrate from"
 msgstr ""
 
-#: ipalib/plugins/migration.py:493
+#: ipalib/plugins/migration.py:504
 msgid "bind password"
 msgstr ""
 
-#: ipalib/plugins/migration.py:500
+#: ipalib/plugins/migration.py:511
 msgid "Bind DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:506
+#: ipalib/plugins/migration.py:517
 msgid "User container"
 msgstr ""
 
-#: ipalib/plugins/migration.py:507
+#: ipalib/plugins/migration.py:518
 msgid "DN of container for users in DS relative to base DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:513
+#: ipalib/plugins/migration.py:524
 msgid "Group container"
 msgstr ""
 
-#: ipalib/plugins/migration.py:514
+#: ipalib/plugins/migration.py:525
 msgid "DN of container for groups in DS relative to base DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:520
+#: ipalib/plugins/migration.py:531
 msgid "User object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:521
+#: ipalib/plugins/migration.py:532
 msgid "Objectclasses used to search for user entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:528
+#: ipalib/plugins/migration.py:539
 msgid "Group object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:529
+#: ipalib/plugins/migration.py:540
 msgid "Objectclasses used to search for group entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:536
+#: ipalib/plugins/migration.py:547
 msgid "Ignore user object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:537
+#: ipalib/plugins/migration.py:548
 msgid "Objectclasses to be ignored for user entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:544
+#: ipalib/plugins/migration.py:555
 msgid "Ignore user attribute"
 msgstr ""
 
-#: ipalib/plugins/migration.py:545
+#: ipalib/plugins/migration.py:556
 msgid "Attributes to be ignored for user entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:552
+#: ipalib/plugins/migration.py:563
 msgid "Ignore group object class"
 msgstr ""
 
-#: ipalib/plugins/migration.py:553
+#: ipalib/plugins/migration.py:564
 msgid "Objectclasses to be ignored for group entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:560
+#: ipalib/plugins/migration.py:571
 msgid "Ignore group attribute"
 msgstr ""
 
-#: ipalib/plugins/migration.py:561
+#: ipalib/plugins/migration.py:572
 msgid "Attributes to be ignored for group entries in DS"
 msgstr ""
 
-#: ipalib/plugins/migration.py:568
+#: ipalib/plugins/migration.py:579
 msgid "Overwrite GID"
 msgstr ""
 
-#: ipalib/plugins/migration.py:569
+#: ipalib/plugins/migration.py:580
 msgid ""
 "When migrating a group already existing in IPA domain overwrite the group "
 "GID and report as success"
 msgstr ""
 
-#: ipalib/plugins/migration.py:574
+#: ipalib/plugins/migration.py:585
 msgid "LDAP schema"
 msgstr ""
 
-#: ipalib/plugins/migration.py:575
+#: ipalib/plugins/migration.py:586
 msgid ""
 "The schema used on the LDAP server. Supported values are RFC2307 and "
 "RFC2307bis. The default is RFC2307bis"
 msgstr ""
 
-#: ipalib/plugins/migration.py:581
+#: ipalib/plugins/migration.py:592
 msgid "Continue"
 msgstr ""
 
-#: ipalib/plugins/migration.py:582
+#: ipalib/plugins/migration.py:593
 msgid ""
 "Continuous operation mode. Errors are reported but the process continues"
 msgstr ""
 
-#: ipalib/plugins/migration.py:587
+#: ipalib/plugins/migration.py:598
 msgid "Base DN"
 msgstr ""
 
-#: ipalib/plugins/migration.py:588
+#: ipalib/plugins/migration.py:599
 msgid "Base DN on remote LDAP server"
 msgstr ""
 
-#: ipalib/plugins/migration.py:592
+#: ipalib/plugins/migration.py:603
 msgid "Ignore compat plugin"
 msgstr ""
 
-#: ipalib/plugins/migration.py:593
+#: ipalib/plugins/migration.py:604
 msgid "Allows migration despite the usage of compat plugin"
 msgstr ""
 
-#: ipalib/plugins/migration.py:601
+#: ipalib/plugins/migration.py:609
+msgid "CA certificate"
+msgstr ""
+
+#: ipalib/plugins/migration.py:610
+msgid "Load CA certificate of LDAP server from FILE"
+msgstr ""
+
+#: ipalib/plugins/migration.py:618
 msgid "Lists of objects migrated; categorized by type."
 msgstr ""
 
-#: ipalib/plugins/migration.py:605
+#: ipalib/plugins/migration.py:622
 msgid "Lists of objects that could not be migrated; categorized by type."
 msgstr ""
 
-#: ipalib/plugins/migration.py:609
+#: ipalib/plugins/migration.py:626
 msgid "False if migration mode was disabled."
 msgstr ""
 
-#: ipalib/plugins/migration.py:613
+#: ipalib/plugins/migration.py:630
 msgid "False if migration fails because the compatibility plug-in is enabled."
 msgstr ""
 
-#: ipalib/plugins/migration.py:617
+#: ipalib/plugins/migration.py:634
 #, python-format
 msgid "%s to exclude from migration"
 msgstr ""
 
-#: ipalib/plugins/migration.py:619
+#: ipalib/plugins/migration.py:636
 msgid ""
 "search results for objects to be migrated\n"
 "have been truncated by the server;\n"
 "migration process might be incomplete\n"
 msgstr ""
 
-#: ipalib/plugins/migration.py:624
+#: ipalib/plugins/migration.py:641
 msgid "Migration mode is disabled. Use 'ipa config-mod' to enable it."
 msgstr ""
 
-#: ipalib/plugins/migration.py:627
+#: ipalib/plugins/migration.py:644
 msgid ""
 "Passwords have been migrated in pre-hashed format.\n"
 "IPA is unable to generate Kerberos keys unless provided\n"
@@ -7421,61 +7915,61 @@ msgid ""
 "can use their Kerberos accounts."
 msgstr ""
 
-#: ipalib/plugins/migration.py:713
+#: ipalib/plugins/migration.py:730
 #, python-format
 msgid ""
 "%(container)s LDAP search did not return any result (search base: "
 "%(search_base)s, objectclass: %(objectclass)s)"
 msgstr ""
 
-#: ipalib/plugins/migration.py:745 ipalib/plugins/user.py:519
+#: ipalib/plugins/migration.py:762 ipalib/plugins/user.py:759
 msgid "Default group for new users not found"
 msgstr ""
 
-#: ipalib/plugins/misc.py:25
+#: ipalib/plugins/misc.py:26
 msgid ""
 "\n"
 "Misc plug-ins\n"
 msgstr ""
 
-#: ipalib/plugins/misc.py:36
+#: ipalib/plugins/misc.py:40
 msgid "Show environment variables."
 msgstr ""
 
-#: ipalib/plugins/misc.py:38
+#: ipalib/plugins/misc.py:42
 #, python-format
 msgid "%(count)d variables"
 msgstr ""
 
-#: ipalib/plugins/misc.py:47 ipalib/plugins/misc.py:115
+#: ipalib/plugins/misc.py:51 ipalib/plugins/misc.py:119
 msgid ""
 "retrieve and print all attributes from the server. Affects command output."
 msgstr ""
 
-#: ipalib/plugins/misc.py:61
+#: ipalib/plugins/misc.py:65
 msgid "Total number of variables env (>= count)"
 msgstr ""
 
-#: ipalib/plugins/misc.py:66
+#: ipalib/plugins/misc.py:70
 msgid "Number of variables returned (<= total)"
 msgstr ""
 
-#: ipalib/plugins/misc.py:106
+#: ipalib/plugins/misc.py:110
 msgid "Show all loaded plugins."
 msgstr ""
 
-#: ipalib/plugins/misc.py:109
+#: ipalib/plugins/misc.py:113
 #, python-format
 msgid "%(count)d plugin loaded"
 msgid_plural "%(count)d plugins loaded"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/misc.py:126
+#: ipalib/plugins/misc.py:130
 msgid "Number of plugins loaded"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:28
+#: ipalib/plugins/netgroup.py:29
 msgid ""
 "\n"
 "Netgroups\n"
@@ -7501,104 +7995,336 @@ msgid ""
 "   ipa netgroup-del admins\n"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:69
+#: ipalib/plugins/netgroup.py:71
 msgid "Member Host"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:81
+#: ipalib/plugins/netgroup.py:85
 msgid "netgroup"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:82
+#: ipalib/plugins/netgroup.py:86
 msgid "netgroups"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:108
+#: ipalib/plugins/netgroup.py:165
 msgid "Netgroups"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:109
+#: ipalib/plugins/netgroup.py:166
 msgid "Netgroup"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:116
+#: ipalib/plugins/netgroup.py:173
 msgid "Netgroup name"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:123
+#: ipalib/plugins/netgroup.py:180
 msgid "Netgroup description"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:129
+#: ipalib/plugins/netgroup.py:186
 msgid "NIS domain name"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:134
+#: ipalib/plugins/netgroup.py:191
 msgid "IPA unique ID"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:156
+#: ipalib/plugins/netgroup.py:212
 msgid "Add a new netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:159
+#: ipalib/plugins/netgroup.py:215
 #, python-format
 msgid "Added netgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:161
+#: ipalib/plugins/netgroup.py:217
 #, python-format
 msgid ""
 "hostgroup with name \"%s\" already exists. Hostgroups and netgroups share a "
 "common namespace"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:193
+#: ipalib/plugins/netgroup.py:248
 msgid "Delete a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:195
+#: ipalib/plugins/netgroup.py:250
 #, python-format
 msgid "Deleted netgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:201
+#: ipalib/plugins/netgroup.py:256
 msgid "Modify a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:204
+#: ipalib/plugins/netgroup.py:259
 #, python-format
 msgid "Modified netgroup \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:222
+#: ipalib/plugins/netgroup.py:277
 msgid "Search for a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:227
+#: ipalib/plugins/netgroup.py:282
 #, python-format
 msgid "%(count)d netgroup matched"
 msgid_plural "%(count)d netgroups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/netgroup.py:237
+#: ipalib/plugins/netgroup.py:292
 msgid "search for managed groups"
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:260
+#: ipalib/plugins/netgroup.py:314
 msgid "Display information about a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:268
+#: ipalib/plugins/netgroup.py:321
 msgid "Add members to a netgroup."
 msgstr ""
 
-#: ipalib/plugins/netgroup.py:284
+#: ipalib/plugins/netgroup.py:343
 msgid "Remove members from a netgroup."
 msgstr ""
 
-#: ipalib/plugins/passwd.py:29
+#: ipalib/plugins/otptoken.py:39
+msgid ""
+"\n"
+"OTP Tokens\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:41
+msgid ""
+"\n"
+"Manage OTP tokens.\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:43
+msgid ""
+"\n"
+"IPA supports the use of OTP tokens for multi-factor authentication. This\n"
+"code enables the management of OTP tokens.\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:48
+msgid ""
+"\n"
+" Add a new token:\n"
+"   ipa otptoken-add --type=totp --owner=jdoe --desc=\"My soft token\"\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:51
+msgid ""
+"\n"
+" Examine the token:\n"
+"   ipa otptoken-show a93db710-a31a-4639-8647-f15b2c70b78a\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:54
+msgid ""
+"\n"
+" Change the vendor:\n"
+"   ipa otptoken-mod a93db710-a31a-4639-8647-f15b2c70b78a --vendor=\"Red Hat"
+"\"\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:57
+msgid ""
+"\n"
+" Delete a token:\n"
+"   ipa otptoken-del a93db710-a31a-4639-8647-f15b2c70b78a\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:113
+msgid "OTP token"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:114
+msgid "OTP tokens"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:130
+msgid "OTP Tokens"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:131
+msgid "OTP Token"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:136 ipalib/plugins/otptoken_yubikey.py:53
+msgid "Unique ID"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:153
+msgid "Owner"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:156 ipalib/plugins/user.py:560
+msgid "Manager"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:161
+msgid "Disabled state"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:165
+msgid "Validity start"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:169
+msgid "Validity end"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:173
+msgid "Vendor"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:179
+msgid "Model"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:185
+msgid "Serial"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:206
+msgid "Digits"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:214
+msgid "Clock offset"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:221
+msgid "Clock interval"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:229
+msgid "Counter"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:240
+msgid "Add a new OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:241
+#, python-format
+msgid "Added OTP token \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:244
+msgid "Display QR code (requires wide terminal)"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:248
+msgid "URI"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:329
+msgid "Delete an OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:330
+#, python-format
+msgid "Deleted OTP token \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:335
+msgid "Modify a OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:336
+#, python-format
+msgid "Modified OTP token \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:349
+msgid "Search for OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:350
+#, python-format
+msgid "%(count)d OTP token matched"
+msgid_plural "%(count)d OTP tokens matched"
+msgstr[0] ""
+msgstr[1] ""
+
+#: ipalib/plugins/otptoken.py:376
+msgid "Display information about an OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:384
+msgid "Add users that can manage this token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:436
+msgid "Synchronize an OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:441
+msgid "User ID"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:443
+msgid "First Code"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:444
+msgid "Second Code"
+msgstr ""
+
+#: ipalib/plugins/otptoken.py:448
+msgid "Token ID"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:30
+msgid ""
+"\n"
+"YubiKey Tokens\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:32
+msgid ""
+"\n"
+"Manage YubiKey tokens.\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:34
+msgid ""
+"\n"
+"This code is an extension to the otptoken plugin and provides support for\n"
+"reading/writing YubiKey tokens directly.\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:39
+msgid ""
+"\n"
+" Add a new token:\n"
+"   ipa otptoken-add-yubikey --owner=jdoe --desc=\"My YubiKey\"\n"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:48
+msgid "Add a new YubiKey OTP token."
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:61
+msgid "YubiKey slot"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:85
+msgid "No YubiKey found"
+msgstr ""
+
+#: ipalib/plugins/otptoken_yubikey.py:95
+msgid "No free YubiKey slot!"
+msgstr ""
+
+#: ipalib/plugins/passwd.py:30
 msgid ""
 "\n"
 "Set a user's password\n"
@@ -7619,181 +8345,403 @@ msgid ""
 "   ipa passwd tuser1\n"
 msgstr ""
 
-#: ipalib/plugins/passwd.py:65
+#: ipalib/plugins/passwd.py:69
 msgid "Set a user's password."
 msgstr ""
 
-#: ipalib/plugins/passwd.py:89
+#: ipalib/plugins/passwd.py:95
+msgid "One Time Password"
+msgstr ""
+
+#: ipalib/plugins/passwd.py:101
 #, python-format
 msgid "Changed password for \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/passwd.py:115
+#: ipalib/plugins/passwd.py:127
 msgid "Invalid credentials"
 msgstr ""
 
-#: ipalib/plugins/permission.py:27
+#: ipalib/plugins/permission.py:33
 msgid ""
 "\n"
 "Permissions\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:35
+msgid ""
 "\n"
 "A permission enables fine-grained delegation of rights. A permission is\n"
-"a human-readable form of a 389-ds Access Control Rule, or instruction "
-"(ACI).\n"
+"a human-readable wrapper around a 389-ds Access Control Rule,\n"
+"or instruction (ACI).\n"
 "A permission grants the right to perform a specific task such as adding a\n"
 "user, modifying a group, etc.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:41
+msgid ""
 "\n"
 "A permission may not contain other permissions.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:43
+msgid ""
 "\n"
-"* A permission grants access to read, write, add or delete.\n"
+"* A permission grants access to read, write, add, delete, read, search,\n"
+"  or compare.\n"
 "* A privilege combines similar permissions (for example all the permissions\n"
 "  needed to add a user).\n"
 "* A role grants a set of privileges to users, groups, hosts or hostgroups.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:49
+msgid ""
 "\n"
 "A permission is made up of a number of different parts:\n"
 "\n"
 "1. The name of the permission.\n"
 "2. The target of the permission.\n"
 "3. The rights granted by the permission.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:55
+msgid ""
 "\n"
 "Rights define what operations are allowed, and may be one or more\n"
 "of the following:\n"
 "1. write - write one or more attributes\n"
 "2. read - read one or more attributes\n"
-"3. add - add a new entry to the tree\n"
-"4. delete - delete an existing entry\n"
-"5. all - all permissions are granted\n"
-"\n"
-"Read permission is granted for most attributes by default so the read\n"
-"permission is not expected to be used very often.\n"
+"3. search - search on one or more attributes\n"
+"4. compare - compare one or more attributes\n"
+"5. add - add a new entry to the tree\n"
+"6. delete - delete an existing entry\n"
+"7. all - all permissions are granted\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:65
+msgid ""
 "\n"
 "Note the distinction between attributes and entries. The permissions are\n"
 "independent, so being able to add a user does not mean that the user will\n"
 "be editable.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:69
+msgid ""
 "\n"
 "There are a number of allowed targets:\n"
-"1. type: a type of object (user, group, etc).\n"
-"2. memberof: a member of a group or hostgroup\n"
-"3. filter: an LDAP filter\n"
-"4. subtree: an LDAP filter specifying part of the LDAP DIT. This is a\n"
-"   super-set of the \"type\" target.\n"
-"5. targetgroup: grant access to modify a specific group (such as granting\n"
-"   the rights to manage group membership)\n"
+"1. subtree: a DN; the permission applies to the subtree under this DN\n"
+"2. target filter: an LDAP filter\n"
+"3. target: DN with possible wildcards, specifies entries permission applies "
+"to\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:74
+msgid ""
 "\n"
-"EXAMPLES:\n"
+"Additionally, there are the following convenience options.\n"
+"Setting one of these options will set the corresponding attribute(s).\n"
+"1. type: a type of object (user, group, etc); sets subtree and target "
+"filter.\n"
+"2. memberof: apply to members of a group; sets target filter\n"
+"3. targetgroup: grant access to modify a specific group (such as granting\n"
+"   the rights to manage group membership); sets target.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:81
+msgid ""
+"\n"
+"Managed permissions\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:83
+msgid ""
+"\n"
+"Permissions that come with IPA by default can be so-called \"managed\"\n"
+"permissions. These have a default set of attributes they apply to,\n"
+"but the administrator can add/remove individual attributes to/from the set.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:87
+msgid ""
+"\n"
+"Deleting or renaming a managed permission, as well as changing its target,\n"
+"is not allowed.\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:92
+msgid ""
 "\n"
 " Add a permission that grants the creation of users:\n"
 "   ipa permission-add --type=user --permissions=add \"Add Users\"\n"
+msgstr ""
+
+#: ipalib/plugins/permission.py:95
+msgid ""
 "\n"
 " Add a permission that grants the ability to manage group membership:\n"
 "   ipa permission-add --attrs=member --permissions=write --type=group "
 "\"Manage Group Members\"\n"
 msgstr ""
 
-#: ipalib/plugins/permission.py:85
-msgid "Permission Type"
+#: ipalib/plugins/permission.py:126
+msgid "must be enclosed in parentheses"
 msgstr ""
 
-#: ipalib/plugins/permission.py:107
+#: ipalib/plugins/permission.py:145
+#, python-format
+msgid "\"%s\" is not an object type"
+msgstr ""
+
+#: ipalib/plugins/permission.py:147 ipalib/plugins/permission.py:832
+#, python-format
+msgid "\"%s\" is not a valid permission type"
+msgstr ""
+
+#: ipalib/plugins/permission.py:168
 msgid "permission"
 msgstr ""
 
-#: ipalib/plugins/permission.py:108
+#: ipalib/plugins/permission.py:169
 msgid "permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:128
+#: ipalib/plugins/permission.py:224
 msgid "Permission name"
 msgstr ""
 
-#: ipalib/plugins/permission.py:136
-msgid "Permissions to grant (read, write, add, delete, all)"
+#: ipalib/plugins/permission.py:234
+msgid "Granted rights"
+msgstr ""
+
+#: ipalib/plugins/permission.py:235
+msgid "Rights to grant (read, search, compare, write, add, delete, all)"
 msgstr ""
 
-#: ipalib/plugins/permission.py:151
+#: ipalib/plugins/permission.py:241
+msgid "Effective attributes"
+msgstr ""
+
+#: ipalib/plugins/permission.py:242
+msgid "All attributes to which the permission applies"
+msgstr ""
+
+#: ipalib/plugins/permission.py:247
+msgid "Included attributes"
+msgstr ""
+
+#: ipalib/plugins/permission.py:248
+msgid "User-specified attributes to which the permission applies"
+msgstr ""
+
+#: ipalib/plugins/permission.py:253
+msgid "Excluded attributes"
+msgstr ""
+
+#: ipalib/plugins/permission.py:254
 msgid ""
-"Type of IPA object (user, group, host, hostgroup, service, netgroup, dns)"
+"User-specified attributes to which the permission explicitly does not apply"
 msgstr ""
 
-#: ipalib/plugins/permission.py:157
-msgid "Member of group"
+#: ipalib/plugins/permission.py:260
+msgid "Default attributes"
+msgstr ""
+
+#: ipalib/plugins/permission.py:261
+msgid "Attributes to which the permission applies by default"
 msgstr ""
 
-#: ipalib/plugins/permission.py:158
-msgid "Target members of a group"
+#: ipalib/plugins/permission.py:267 ipalib/plugins/permission.py:268
+msgid "Bind rule type"
 msgstr ""
 
-#: ipalib/plugins/permission.py:170
+#: ipalib/plugins/permission.py:278
 msgid "Subtree to apply permissions to"
 msgstr ""
 
-#: ipalib/plugins/permission.py:176
-msgid "User group to apply permissions to"
+#: ipalib/plugins/permission.py:284 ipalib/plugins/permission.py:285
+msgid "Extra target filter"
 msgstr ""
 
-#: ipalib/plugins/permission.py:201
-msgid "Add a new permission."
+#: ipalib/plugins/permission.py:291
+msgid "Raw target filter"
+msgstr ""
+
+#: ipalib/plugins/permission.py:292
+msgid "All target filters, including those implied by type and memberof"
+msgstr ""
+
+#: ipalib/plugins/permission.py:299
+msgid "ACI target DN"
+msgstr ""
+
+#: ipalib/plugins/permission.py:304
+msgid "Member of group"
+msgstr ""
+
+#: ipalib/plugins/permission.py:305
+msgid "Target members of a group (sets memberOf targetfilter)"
+msgstr ""
+
+#: ipalib/plugins/permission.py:310
+msgid "User group to apply permissions to (sets target)"
+msgstr ""
+
+#: ipalib/plugins/permission.py:316
+msgid "Type of IPA object (sets subtree and objectClass targetfilter)"
+msgstr ""
+
+#: ipalib/plugins/permission.py:322
+#, python-format
+msgid "Deprecated; use %s"
+msgstr ""
+
+#: ipalib/plugins/permission.py:333
+#, python-format
+msgid "Permission with unknown flag %s may not be modified or removed"
+msgstr ""
+
+#: ipalib/plugins/permission.py:337
+msgid "A SYSTEM permission may not be modified or removed"
+msgstr ""
+
+#: ipalib/plugins/permission.py:565
+#, python-format
+msgid "Entry %s not found"
+msgstr ""
+
+#: ipalib/plugins/permission.py:651
+#, python-format
+msgid "The ACI for permission %(name)s was not found in %(dn)s "
+msgstr ""
+
+#: ipalib/plugins/permission.py:755
+msgid ""
+"cannot specify full target filter and extra target filter simultaneously"
+msgstr ""
+
+#: ipalib/plugins/permission.py:778
+#, python-format
+msgid "option was renamed; use %s"
+msgstr ""
+
+#: ipalib/plugins/permission.py:782
+#, python-format
+msgid "Cannot use %(old_name)s with %(new_name)s"
 msgstr ""
 
-#: ipalib/plugins/permission.py:203 ipalib/plugins/permission.py:259
+#: ipalib/plugins/permission.py:796 ipalib/plugins/permission.py:811
+#, python-format
+msgid "%s: group not found"
+msgstr ""
+
+#: ipalib/plugins/permission.py:806
+msgid "target and targetgroup are mutually exclusive"
+msgstr ""
+
+#: ipalib/plugins/permission.py:827
+msgid "subtree and type are mutually exclusive"
+msgstr ""
+
+#: ipalib/plugins/permission.py:863
+msgid "Bad search filter"
+msgstr ""
+
+#: ipalib/plugins/permission.py:873
+#, python-format
+msgid "Entry %s does not exist"
+msgstr ""
+
+#: ipalib/plugins/permission.py:882
+msgid ""
+"there must be at least one target entry specifier (e.g. target, "
+"targetfilter, attrs)"
+msgstr ""
+
+#: ipalib/plugins/permission.py:892
+msgid "Add a system permission without an ACI (internal command)"
+msgstr ""
+
+#: ipalib/plugins/permission.py:894 ipalib/plugins/permission.py:925
 #, python-format
 msgid "Added permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/permission.py:257
-msgid "Add a system permission without an ACI"
+#: ipalib/plugins/permission.py:900
+msgid "Permission flags"
 msgstr ""
 
-#: ipalib/plugins/permission.py:265
-msgid "Permission type"
+#: ipalib/plugins/permission.py:923
+msgid "Add a new permission."
 msgstr ""
 
-#: ipalib/plugins/permission.py:292
+#: ipalib/plugins/permission.py:951
+msgid "attrs and included attributes are mutually exclusive"
+msgstr ""
+
+#: ipalib/plugins/permission.py:985
 msgid "Delete a permission."
 msgstr ""
 
-#: ipalib/plugins/permission.py:294
+#: ipalib/plugins/permission.py:987
 #, python-format
 msgid "Deleted permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/permission.py:300
+#: ipalib/plugins/permission.py:993
 msgid "force delete of SYSTEM permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:308
-msgid "A SYSTEM permission may not be removed"
+#: ipalib/plugins/permission.py:1007
+msgid "cannot delete managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:320
+#: ipalib/plugins/permission.py:1013
+#, python-format
+msgid "ACI of permission %s was not found"
+msgstr ""
+
+#: ipalib/plugins/permission.py:1020
 msgid "Modify a permission."
 msgstr ""
 
-#: ipalib/plugins/permission.py:322
+#: ipalib/plugins/permission.py:1022
 #, python-format
 msgid "Modified permission \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/permission.py:329
-msgid "A SYSTEM permission may not be modified"
+#: ipalib/plugins/permission.py:1056
+msgid "cannot rename managed permissions"
+msgstr ""
+
+#: ipalib/plugins/permission.py:1063 ipalib/plugins/permission.py:1067
+msgid "not modifiable on managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:354
-msgid "New name can not be empty"
+#: ipalib/plugins/permission.py:1074
+msgid "only available on managed permissions"
 msgstr ""
 
-#: ipalib/plugins/permission.py:410
+#: ipalib/plugins/permission.py:1081 ipalib/plugins/permission.py:1201
+msgid "attrs and included/excluded attributes are mutually exclusive"
+msgstr ""
+
+#: ipalib/plugins/permission.py:1092
+msgid "cannot set bindtype for a permission that is assigned to a privilege"
+msgstr ""
+
+#: ipalib/plugins/permission.py:1186
 msgid "Search for permissions."
 msgstr ""
 
-#: ipalib/plugins/permission.py:413
+#: ipalib/plugins/permission.py:1189
 #, python-format
 msgid "%(count)d permission matched"
 msgid_plural "%(count)d permissions matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/permission.py:492
+#: ipalib/plugins/permission.py:1316
 msgid "Display information about a permission."
 msgstr ""
 
@@ -7831,7 +8779,7 @@ msgstr ""
 msgid "Ping a remote server."
 msgstr ""
 
-#: ipalib/plugins/pkinit.py:26
+#: ipalib/plugins/pkinit.py:27
 msgid ""
 "\n"
 "Kerberos pkinit options\n"
@@ -7853,24 +8801,24 @@ msgid ""
 "http://k5wiki.kerberos.org/wiki/Projects/Anonymous_pkinit\n"
 msgstr ""
 
-#: ipalib/plugins/pkinit.py:50
+#: ipalib/plugins/pkinit.py:54
 msgid "pkinit"
 msgstr ""
 
-#: ipalib/plugins/pkinit.py:52
+#: ipalib/plugins/pkinit.py:56
 msgid "PKINIT"
 msgstr ""
 
-#: ipalib/plugins/pkinit.py:64
+#: ipalib/plugins/pkinit.py:67
 #, python-format
 msgid "Unknown command %s"
 msgstr ""
 
-#: ipalib/plugins/pkinit.py:68
+#: ipalib/plugins/pkinit.py:72
 msgid "Enable or Disable Anonymous PKINIT."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:23
+#: ipalib/plugins/privilege.py:24
 msgid ""
 "\n"
 "Privileges\n"
@@ -7893,93 +8841,100 @@ msgid ""
 "See role and permission for additional information.\n"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:49
+#: ipalib/plugins/privilege.py:54
 msgid "privilege"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:50
+#: ipalib/plugins/privilege.py:55
 msgid "privileges"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:62
+#: ipalib/plugins/privilege.py:96
 msgid "Privileges"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:63
+#: ipalib/plugins/privilege.py:97
 msgid "Privilege"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:68
+#: ipalib/plugins/privilege.py:102
 msgid "Privilege name"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:74
+#: ipalib/plugins/privilege.py:108
 msgid "Privilege description"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:82
+#: ipalib/plugins/privilege.py:115
 msgid "Add a new privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:84
+#: ipalib/plugins/privilege.py:117
 #, python-format
 msgid "Added privilege \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/privilege.py:90
+#: ipalib/plugins/privilege.py:122
 msgid "Delete a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:92
+#: ipalib/plugins/privilege.py:124
 #, python-format
 msgid "Deleted privilege \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/privilege.py:98
+#: ipalib/plugins/privilege.py:129
 msgid "Modify a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:100
+#: ipalib/plugins/privilege.py:131
 #, python-format
 msgid "Modified privilege \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/privilege.py:106
+#: ipalib/plugins/privilege.py:136
 msgid "Search for privileges."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:109
+#: ipalib/plugins/privilege.py:139
 #, python-format
 msgid "%(count)d privilege matched"
 msgid_plural "%(count)d privileges matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/privilege.py:116
+#: ipalib/plugins/privilege.py:145
 msgid "Display information about a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:122
+#: ipalib/plugins/privilege.py:150
 msgid "Add members to a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:139
+#: ipalib/plugins/privilege.py:165
 msgid "Add permissions to a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:154
+#: ipalib/plugins/privilege.py:180
 msgid "Number of permissions added"
 msgstr ""
 
-#: ipalib/plugins/privilege.py:162
+#: ipalib/plugins/privilege.py:205
+#, python-format
+msgid ""
+"cannot add permission \"%(perm)s\" with bindtype \"%(bindtype)s\" to a "
+"privilege"
+msgstr ""
+
+#: ipalib/plugins/privilege.py:218
 msgid "Remove permissions from a privilege."
 msgstr ""
 
-#: ipalib/plugins/privilege.py:179
+#: ipalib/plugins/privilege.py:235
 msgid "Number of permissions removed"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:30
+#: ipalib/plugins/pwpolicy.py:31
 msgid ""
 "\n"
 "Password policy\n"
@@ -8025,135 +8980,304 @@ msgid ""
 "   ipa pwpolicy-mod --minclasses=2 localadmins\n"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:90
+#: ipalib/plugins/pwpolicy.py:130
 #, python-format
 msgid "priority must be a unique value (%(prio)d already used by %(gname)s)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:180
+#: ipalib/plugins/pwpolicy.py:214
 msgid "password policy"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:181
+#: ipalib/plugins/pwpolicy.py:215
 msgid "password policies"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:205
+#: ipalib/plugins/pwpolicy.py:284
 msgid "Max failures"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:206
+#: ipalib/plugins/pwpolicy.py:285
 msgid "Consecutive failures before lockout"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:211
+#: ipalib/plugins/pwpolicy.py:290
 msgid "Failure reset interval"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:212
+#: ipalib/plugins/pwpolicy.py:291
 msgid "Period after which failure count will be reset (seconds)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:217
+#: ipalib/plugins/pwpolicy.py:296
 msgid "Lockout duration"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:218
+#: ipalib/plugins/pwpolicy.py:297
 msgid "Period for which lockout is enforced (seconds)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:223
+#: ipalib/plugins/pwpolicy.py:302
 msgid "Password Policies"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:229
+#: ipalib/plugins/pwpolicy.py:308
 msgid "Group"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:230
+#: ipalib/plugins/pwpolicy.py:309
 msgid "Manage password policy for specific group"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:235
+#: ipalib/plugins/pwpolicy.py:314
 msgid "Max lifetime (days)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:236
+#: ipalib/plugins/pwpolicy.py:315
 msgid "Maximum password lifetime (in days)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:242
+#: ipalib/plugins/pwpolicy.py:321
 msgid "Min lifetime (hours)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:243
+#: ipalib/plugins/pwpolicy.py:322
 msgid "Minimum password lifetime (in hours)"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:248
+#: ipalib/plugins/pwpolicy.py:327
 msgid "History size"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:249
+#: ipalib/plugins/pwpolicy.py:328
 msgid "Password history size"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:254
+#: ipalib/plugins/pwpolicy.py:333
 msgid "Character classes"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:255
+#: ipalib/plugins/pwpolicy.py:334
 msgid "Minimum number of character classes"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:261
+#: ipalib/plugins/pwpolicy.py:340
 msgid "Min length"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:262
+#: ipalib/plugins/pwpolicy.py:341
 msgid "Minimum length of password"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:268
+#: ipalib/plugins/pwpolicy.py:347
 msgid "Priority of the policy (higher number means lower priority"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:322
+#: ipalib/plugins/pwpolicy.py:401
 msgid "Maximum password life must be greater than minimum."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:341
+#: ipalib/plugins/pwpolicy.py:419
 msgid "Add a new group password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:368
+#: ipalib/plugins/pwpolicy.py:445
 msgid "Delete a group password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:380
+#: ipalib/plugins/pwpolicy.py:457
 msgid "cannot delete global password policy"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:396
+#: ipalib/plugins/pwpolicy.py:472
 msgid "Modify a group password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:407
+#: ipalib/plugins/pwpolicy.py:483
 msgid "priority cannot be set on global policy"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:440
+#: ipalib/plugins/pwpolicy.py:515
 msgid "Display information about password policy."
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:445
+#: ipalib/plugins/pwpolicy.py:520
 msgid "Display effective policy for a specific user"
 msgstr ""
 
-#: ipalib/plugins/pwpolicy.py:470
+#: ipalib/plugins/pwpolicy.py:544
 msgid "Search for group password policies."
 msgstr ""
 
+#: ipalib/plugins/radiusproxy.py:27
+msgid ""
+"\n"
+"RADIUS Proxy Servers\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:29
+msgid ""
+"\n"
+"Manage RADIUS Proxy Servers.\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:31
+msgid ""
+"\n"
+"IPA supports the use of an external RADIUS proxy server for krb5 OTP\n"
+"authentications. This permits a great deal of flexibility when\n"
+"integrating with third-party authentication services.\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:37
+msgid ""
+"\n"
+" Add a new server:\n"
+"   ipa radiusproxy-add MyRADIUS --server=radius.example.com:1812\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:40
+msgid ""
+"\n"
+" Find all servers whose entries include the string \"example.com\":\n"
+"   ipa radiusproxy-find example.com\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:43
+msgid ""
+"\n"
+" Examine the configuration:\n"
+"   ipa radiusproxy-show MyRADIUS\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:46
+msgid ""
+"\n"
+" Change the secret:\n"
+"   ipa radiusproxy-mod MyRADIUS --secret\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:49
+msgid ""
+"\n"
+" Delete a configuration:\n"
+"   ipa radiusproxy-del MyRADIUS\n"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:60
+msgid "invalid attribute name"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:72
+msgid "invalid port number"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:90
+msgid "RADIUS proxy server"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:91
+msgid "RADIUS proxy servers"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:98
+msgid "RADIUS Servers"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:99
+msgid "RADIUS Server"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:104
+msgid "RADIUS proxy server name"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:110
+msgid "A description of this RADIUS proxy server"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:114 ipalib/plugins/user.py:101
+msgid "Server"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:115
+msgid "The hostname or IP (with or without port)"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:119
+msgid "Secret"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:120
+msgid "The secret used to encrypt data"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:126
+msgid "Timeout"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:127
+msgid "The total timeout across all retries (in seconds)"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:132
+msgid "Retries"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:133
+msgid "The number of times to retry authentication"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:139
+msgid "User attribute"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:140
+msgid "The username attribute on the user object"
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:146
+msgid "Add a new RADIUS proxy server."
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:147
+#, python-format
+msgid "Added RADIUS proxy server \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:151
+msgid "Delete a RADIUS proxy server."
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:152
+#, python-format
+msgid "Deleted RADIUS proxy server \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:156
+msgid "Modify a RADIUS proxy server."
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:157
+#, python-format
+msgid "Modified RADIUS proxy server \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:161
+msgid "Search for RADIUS proxy servers."
+msgstr ""
+
+#: ipalib/plugins/radiusproxy.py:163
+#, python-format
+msgid "%(count)d RADIUS proxy server matched"
+msgid_plural "%(count)d RADIUS proxy servers matched"
+msgstr[0] ""
+msgstr[1] ""
+
+#: ipalib/plugins/radiusproxy.py:168
+msgid "Display information about a RADIUS proxy server."
+msgstr ""
+
 #: ipalib/plugins/realmdomains.py:30
 msgid ""
 "\n"
@@ -8177,51 +9301,51 @@ msgid ""
 "   ipa realmdomains-mod --del-domain=olddomain.com\n"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:61
+#: ipalib/plugins/realmdomains.py:70
 msgid "Realm domains"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:79
+#: ipalib/plugins/realmdomains.py:98
 msgid "Add domain"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:85
+#: ipalib/plugins/realmdomains.py:104
 msgid "Delete domain"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:93
+#: ipalib/plugins/realmdomains.py:112
 msgid "Modify realm domains."
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:98
+#: ipalib/plugins/realmdomains.py:117
 msgid "Force adding domain even if not in DNS"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:111
+#: ipalib/plugins/realmdomains.py:130
 msgid ""
 "you cannot specify the --domain option together with --add-domain or --del-"
 "domain"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:113 ipalib/plugins/realmdomains.py:133
+#: ipalib/plugins/realmdomains.py:132 ipalib/plugins/realmdomains.py:152
 msgid "cannot delete domain of IPA server"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:118
+#: ipalib/plugins/realmdomains.py:137
 #, python-format
 msgid "no SOA or NS records found for domains: %s"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:127
+#: ipalib/plugins/realmdomains.py:146
 #, python-format
 msgid "no SOA or NS records found for domain %s"
 msgstr ""
 
-#: ipalib/plugins/realmdomains.py:190
+#: ipalib/plugins/realmdomains.py:209
 msgid "Display the list of realm domains."
 msgstr ""
 
-#: ipalib/plugins/role.py:26
+#: ipalib/plugins/role.py:27
 msgid ""
 "\n"
 "Roles\n"
@@ -8260,93 +9384,93 @@ msgid ""
 " add users, reset passwords or add a user to the default IPA user group.\n"
 msgstr ""
 
-#: ipalib/plugins/role.py:66
+#: ipalib/plugins/role.py:70
 msgid "role"
 msgstr ""
 
-#: ipalib/plugins/role.py:67
+#: ipalib/plugins/role.py:71
 msgid "roles"
 msgstr ""
 
-#: ipalib/plugins/role.py:82
+#: ipalib/plugins/role.py:129
 msgid "Role"
 msgstr ""
 
-#: ipalib/plugins/role.py:87
+#: ipalib/plugins/role.py:134
 msgid "Role name"
 msgstr ""
 
-#: ipalib/plugins/role.py:93
+#: ipalib/plugins/role.py:140
 msgid "A description of this role-group"
 msgstr ""
 
-#: ipalib/plugins/role.py:101
+#: ipalib/plugins/role.py:148
 msgid "Add a new role."
 msgstr ""
 
-#: ipalib/plugins/role.py:103
+#: ipalib/plugins/role.py:150
 #, python-format
 msgid "Added role \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/role.py:109
+#: ipalib/plugins/role.py:156
 msgid "Delete a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:111
+#: ipalib/plugins/role.py:158
 #, python-format
 msgid "Deleted role \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/role.py:117
+#: ipalib/plugins/role.py:164
 msgid "Modify a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:119
+#: ipalib/plugins/role.py:166
 #, python-format
 msgid "Modified role \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/role.py:125
+#: ipalib/plugins/role.py:172
 msgid "Search for roles."
 msgstr ""
 
-#: ipalib/plugins/role.py:128
+#: ipalib/plugins/role.py:175
 #, python-format
 msgid "%(count)d role matched"
 msgid_plural "%(count)d roles matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/role.py:135
+#: ipalib/plugins/role.py:182
 msgid "Display information about a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:141
+#: ipalib/plugins/role.py:188
 msgid "Add members to a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:147
+#: ipalib/plugins/role.py:194
 msgid "Remove members from a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:153
+#: ipalib/plugins/role.py:200
 msgid "Add privileges to a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:168
+#: ipalib/plugins/role.py:215
 msgid "Number of privileges added"
 msgstr ""
 
-#: ipalib/plugins/role.py:176
+#: ipalib/plugins/role.py:223
 msgid "Remove privileges from a role."
 msgstr ""
 
-#: ipalib/plugins/role.py:191
+#: ipalib/plugins/role.py:238
 msgid "Number of privileges removed"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:28
+#: ipalib/plugins/selfservice.py:29
 msgid ""
 "\n"
 "Self-service Permissions\n"
@@ -8379,73 +9503,73 @@ msgid ""
 "   ipa selfservice-del \"Users manage their own address\"\n"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:71
+#: ipalib/plugins/selfservice.py:75
 msgid "self service permission"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:72
+#: ipalib/plugins/selfservice.py:76
 msgid "self service permissions"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:73
+#: ipalib/plugins/selfservice.py:77
 msgid "Self Service Permissions"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:74
+#: ipalib/plugins/selfservice.py:78
 msgid "Self Service Permission"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:79 ipalib/plugins/selfservice.py:80
+#: ipalib/plugins/selfservice.py:83 ipalib/plugins/selfservice.py:84
 msgid "Self-service name"
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:94
+#: ipalib/plugins/selfservice.py:98
 msgid "Attributes to which the permission applies."
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:123
+#: ipalib/plugins/selfservice.py:127
 msgid "Add a new self-service permission."
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:125
+#: ipalib/plugins/selfservice.py:129
 #, python-format
 msgid "Added selfservice \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:145
+#: ipalib/plugins/selfservice.py:149
 msgid "Delete a self-service permission."
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:148
+#: ipalib/plugins/selfservice.py:152
 #, python-format
 msgid "Deleted selfservice \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:163
+#: ipalib/plugins/selfservice.py:167
 msgid "Modify a self-service permission."
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:165
+#: ipalib/plugins/selfservice.py:169
 #, python-format
 msgid "Modified selfservice \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:185
+#: ipalib/plugins/selfservice.py:189
 msgid "Search for a self-service permission."
 msgstr ""
 
-#: ipalib/plugins/selfservice.py:188
+#: ipalib/plugins/selfservice.py:192
 #, python-format
 msgid "%(count)d selfservice matched"
 msgid_plural "%(count)d selfservices matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/selfservice.py:212
+#: ipalib/plugins/selfservice.py:216
 msgid "Display information about a self-service permission."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:26
+#: ipalib/plugins/selinuxusermap.py:27
 msgid ""
 "\n"
 "SELinux User Mapping\n"
@@ -8496,138 +9620,138 @@ msgid ""
 " and the default SELinux user are available in the config-show command.\n"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:71
+#: ipalib/plugins/selinuxusermap.py:74
 msgid "HBAC rule and local members cannot both be set"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:98
+#: ipalib/plugins/selinuxusermap.py:101
 msgid "Invalid SELinux user name, only a-Z and _ are allowed"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:100
+#: ipalib/plugins/selinuxusermap.py:103
 msgid "Invalid MLS value, must match s[0-15](-s[0-15])"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:103
+#: ipalib/plugins/selinuxusermap.py:106
 msgid ""
 "Invalid MCS value, must match c[0-1023].c[0-1023] and/or c[0-1023]-c[0-c0123]"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:118
+#: ipalib/plugins/selinuxusermap.py:121
 msgid "SELinux user map list not found in configuration"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:123
+#: ipalib/plugins/selinuxusermap.py:126
 #, python-format
 msgid "SELinux user %(user)s not found in ordering list (in config)"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:134
+#: ipalib/plugins/selinuxusermap.py:138
 msgid "SELinux User Map rule"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:135
+#: ipalib/plugins/selinuxusermap.py:139
 msgid "SELinux User Map rules"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:152
+#: ipalib/plugins/selinuxusermap.py:195
 msgid "SELinux User Maps"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:153
+#: ipalib/plugins/selinuxusermap.py:196
 msgid "SELinux User Map"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:163
+#: ipalib/plugins/selinuxusermap.py:206
 msgid "SELinux User"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:168
+#: ipalib/plugins/selinuxusermap.py:211
 msgid "HBAC Rule that defines the users, groups and hostgroups"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:228
+#: ipalib/plugins/selinuxusermap.py:271
 #, python-format
 msgid "HBAC rule %(rule)s not found"
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:247
+#: ipalib/plugins/selinuxusermap.py:290
 msgid "Create a new SELinux User Map."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:249
+#: ipalib/plugins/selinuxusermap.py:292
 #, python-format
 msgid "Added SELinux User Map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:284
+#: ipalib/plugins/selinuxusermap.py:327
 msgid "Delete a SELinux User Map."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:286
+#: ipalib/plugins/selinuxusermap.py:329
 #, python-format
 msgid "Deleted SELinux User Map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:292
+#: ipalib/plugins/selinuxusermap.py:335
 msgid "Modify a SELinux User Map."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:294
+#: ipalib/plugins/selinuxusermap.py:337
 #, python-format
 msgid "Modified SELinux User Map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:348
+#: ipalib/plugins/selinuxusermap.py:391
 msgid "Search for SELinux User Maps."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:351
+#: ipalib/plugins/selinuxusermap.py:394
 #, python-format
 msgid "%(count)d SELinux User Map matched"
 msgid_plural "%(count)d SELinux User Maps matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/selinuxusermap.py:381
+#: ipalib/plugins/selinuxusermap.py:423
 msgid "Display the properties of a SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:392
+#: ipalib/plugins/selinuxusermap.py:434
 msgid "Enable an SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:394
+#: ipalib/plugins/selinuxusermap.py:436
 #, python-format
 msgid "Enabled SELinux User Map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:419
+#: ipalib/plugins/selinuxusermap.py:464
 msgid "Disable an SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:421
+#: ipalib/plugins/selinuxusermap.py:466
 #, python-format
 msgid "Disabled SELinux User Map \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:446
+#: ipalib/plugins/selinuxusermap.py:494
 msgid "Add users and groups to an SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:469
+#: ipalib/plugins/selinuxusermap.py:518
 msgid "Remove users and groups from an SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:478
+#: ipalib/plugins/selinuxusermap.py:527
 msgid "Add target hosts and hostgroups to an SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/selinuxusermap.py:501
+#: ipalib/plugins/selinuxusermap.py:551
 msgid "Remove target hosts and hostgroups from an SELinux User Map rule."
 msgstr ""
 
-#: ipalib/plugins/service.py:35
+#: ipalib/plugins/service.py:36
 msgid ""
 "\n"
 "Services\n"
@@ -8690,133 +9814,133 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/service.py:133
+#: ipalib/plugins/service.py:136
 msgid "Requires pre-authentication"
 msgstr ""
 
-#: ipalib/plugins/service.py:134
+#: ipalib/plugins/service.py:137
 msgid "Pre-authentication is required for the service"
 msgstr ""
 
-#: ipalib/plugins/service.py:139
+#: ipalib/plugins/service.py:142
 msgid "Trusted for delegation"
 msgstr ""
 
-#: ipalib/plugins/service.py:140
+#: ipalib/plugins/service.py:143
 msgid "Client credentials may be delegated to the service"
 msgstr ""
 
-#: ipalib/plugins/service.py:159
+#: ipalib/plugins/service.py:162
 msgid "missing service"
 msgstr ""
 
-#: ipalib/plugins/service.py:163
+#: ipalib/plugins/service.py:166
 msgid "blank service"
 msgstr ""
 
-#: ipalib/plugins/service.py:167
+#: ipalib/plugins/service.py:170
 msgid "unable to determine realm"
 msgstr ""
 
-#: ipalib/plugins/service.py:240
+#: ipalib/plugins/service.py:243
 msgid "This principal is required by the IPA master"
 msgstr ""
 
-#: ipalib/plugins/service.py:295
+#: ipalib/plugins/service.py:299
 msgid "service"
 msgstr ""
 
-#: ipalib/plugins/service.py:296
+#: ipalib/plugins/service.py:300
 msgid "services"
 msgstr ""
 
-#: ipalib/plugins/service.py:322
+#: ipalib/plugins/service.py:372
 msgid "Service principal"
 msgstr ""
 
-#: ipalib/plugins/service.py:334
+#: ipalib/plugins/service.py:384
 msgid "PAC type"
 msgstr ""
 
-#: ipalib/plugins/service.py:335
+#: ipalib/plugins/service.py:385
 msgid ""
 "Override default list of supported PAC types. Use 'NONE' to disable PAC "
 "support for this service, e.g. this might be necessary for NFS services."
 msgstr ""
 
-#: ipalib/plugins/service.py:356
+#: ipalib/plugins/service.py:406
 msgid "NONE value cannot be combined with other PAC types"
 msgstr ""
 
-#: ipalib/plugins/service.py:362
+#: ipalib/plugins/service.py:412
 msgid "Add a new IPA new service."
 msgstr ""
 
-#: ipalib/plugins/service.py:364
+#: ipalib/plugins/service.py:414
 #, python-format
 msgid "Added service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:370
+#: ipalib/plugins/service.py:420
 msgid "force principal name even if not in DNS"
 msgstr ""
 
-#: ipalib/plugins/service.py:384
+#: ipalib/plugins/service.py:434
 #, python-format
 msgid "The host '%s' does not exist to add a service to."
 msgstr ""
 
-#: ipalib/plugins/service.py:424
+#: ipalib/plugins/service.py:474
 msgid "Delete an IPA service."
 msgstr ""
 
-#: ipalib/plugins/service.py:426
+#: ipalib/plugins/service.py:476
 #, python-format
 msgid "Deleted service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:469
+#: ipalib/plugins/service.py:519
 msgid "Modify an existing IPA service."
 msgstr ""
 
-#: ipalib/plugins/service.py:471
+#: ipalib/plugins/service.py:521
 #, python-format
 msgid "Modified service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/service.py:517
+#: ipalib/plugins/service.py:566
 msgid "Search for IPA services."
 msgstr ""
 
-#: ipalib/plugins/service.py:520
+#: ipalib/plugins/service.py:569
 #, python-format
 msgid "%(count)d service matched"
 msgid_plural "%(count)d services matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/service.py:555
+#: ipalib/plugins/service.py:603
 msgid "Display information about an IPA service."
 msgstr ""
 
-#: ipalib/plugins/service.py:590
+#: ipalib/plugins/service.py:638
 msgid "Add hosts that can manage this service."
 msgstr ""
 
-#: ipalib/plugins/service.py:599
+#: ipalib/plugins/service.py:647
 msgid "Remove hosts that can manage this service."
 msgstr ""
 
-#: ipalib/plugins/service.py:608
+#: ipalib/plugins/service.py:656
 msgid "Disable the Kerberos key and SSL certificate of a service."
 msgstr ""
 
-#: ipalib/plugins/service.py:611
+#: ipalib/plugins/service.py:659
 #, python-format
 msgid "Disabled service \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:29
+#: ipalib/plugins/sudocmd.py:30
 msgid ""
 "\n"
 "Sudo Commands\n"
@@ -8833,73 +9957,73 @@ msgid ""
 "\n"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:44 ipalib/plugins/sudocmdgroup.py:48
+#: ipalib/plugins/sudocmd.py:47 ipalib/plugins/sudocmdgroup.py:51
 msgid "commands for controlling sudo configuration"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:51
+#: ipalib/plugins/sudocmd.py:55
 msgid "sudo command"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:52
+#: ipalib/plugins/sudocmd.py:56
 msgid "sudo commands"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:66
+#: ipalib/plugins/sudocmd.py:108
 msgid "Sudo Commands"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:67 ipalib/plugins/sudocmd.py:72
+#: ipalib/plugins/sudocmd.py:109 ipalib/plugins/sudocmd.py:114
 msgid "Sudo Command"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:78
+#: ipalib/plugins/sudocmd.py:120
 msgid "A description of this command"
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:101
+#: ipalib/plugins/sudocmd.py:143
 msgid "Create new Sudo Command."
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:103
+#: ipalib/plugins/sudocmd.py:145
 #, python-format
 msgid "Added Sudo Command \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:108
+#: ipalib/plugins/sudocmd.py:150
 msgid "Delete Sudo Command."
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:110
+#: ipalib/plugins/sudocmd.py:152
 #, python-format
 msgid "Deleted Sudo Command \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:141
+#: ipalib/plugins/sudocmd.py:183
 msgid "Modify Sudo Command."
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:143
+#: ipalib/plugins/sudocmd.py:185
 #, python-format
 msgid "Modified Sudo Command \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:148
+#: ipalib/plugins/sudocmd.py:190
 msgid "Search for Sudo Commands."
 msgstr ""
 
-#: ipalib/plugins/sudocmd.py:151
+#: ipalib/plugins/sudocmd.py:193
 #, python-format
 msgid "%(count)d Sudo Command matched"
 msgid_plural "%(count)d Sudo Commands matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/sudocmd.py:157
+#: ipalib/plugins/sudocmd.py:199
 msgid "Display Sudo Command."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:25
+#: ipalib/plugins/sudocmdgroup.py:26
 msgid ""
 "\n"
 "Groups of Sudo Commands\n"
@@ -8925,77 +10049,85 @@ msgid ""
 "   ipa group-show localadmins\n"
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:55
+#: ipalib/plugins/sudocmdgroup.py:59
 msgid "sudo command group"
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:56
+#: ipalib/plugins/sudocmdgroup.py:60
 msgid "sudo command groups"
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:67 ipalib/plugins/sudocmdgroup.py:72
+#: ipalib/plugins/sudocmdgroup.py:111 ipalib/plugins/sudocmdgroup.py:116
 msgid "Sudo Command Group"
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:95
+#: ipalib/plugins/sudocmdgroup.py:139
 msgid "Create new Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:97
+#: ipalib/plugins/sudocmdgroup.py:141
 #, python-format
 msgid "Added Sudo Command Group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:103
+#: ipalib/plugins/sudocmdgroup.py:147
 msgid "Delete Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:105
+#: ipalib/plugins/sudocmdgroup.py:149
 #, python-format
 msgid "Deleted Sudo Command Group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:111
+#: ipalib/plugins/sudocmdgroup.py:155
 msgid "Modify Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:113
+#: ipalib/plugins/sudocmdgroup.py:157
 #, python-format
 msgid "Modified Sudo Command Group \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:119
+#: ipalib/plugins/sudocmdgroup.py:163
 msgid "Search for Sudo Command Groups."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:122
+#: ipalib/plugins/sudocmdgroup.py:166
 #, python-format
 msgid "%(count)d Sudo Command Group matched"
 msgid_plural "%(count)d Sudo Command Groups matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/sudocmdgroup.py:130
+#: ipalib/plugins/sudocmdgroup.py:174
 msgid "Display Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:136
+#: ipalib/plugins/sudocmdgroup.py:180
 msgid "Add members to Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudocmdgroup.py:142
+#: ipalib/plugins/sudocmdgroup.py:186
 msgid "Remove members from Sudo Command Group."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:26
+#: ipalib/plugins/sudorule.py:38
 msgid ""
 "\n"
 "Sudo Rules\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:40
+msgid ""
 "\n"
 "Sudo (su \"do\") allows a system administrator to delegate authority to\n"
 "give certain users (or groups of users) the ability to run some (or all)\n"
 "commands as root or another user while providing an audit trail of the\n"
 "commands and their arguments.\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:45
+msgid ""
 "\n"
 "FreeIPA provides a means to configure the various aspects of Sudo:\n"
 "   Users: The user(s)/group(s) allowed to invoke Sudo.\n"
@@ -9007,308 +10139,401 @@ msgid ""
 "invoked with.\n"
 "   RunAsGroup: The group(s) whose gid rights Sudo will be invoked with.\n"
 "   Options: The various Sudoers Options that can modify Sudo's behavior.\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:54
+msgid ""
 "\n"
 "An order can be added to a sudorule to control the order in which they\n"
 "are evaluated (if the client supports it). This order is an integer and\n"
 "must be unique.\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:58
+msgid ""
 "\n"
 "FreeIPA provides a designated binddn to use with Sudo located at:\n"
 "uid=sudo,cn=sysaccounts,cn=etc,dc=example,dc=com\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:61
+msgid ""
 "\n"
 "To enable the binddn run the following command to set the password:\n"
 "LDAPTLS_CACERT=/etc/ipa/ca.crt /usr/bin/ldappasswd -S -W -h ipa.example.com -"
 "ZZ -D \"cn=Directory Manager\" uid=sudo,cn=sysaccounts,cn=etc,dc=example,"
 "dc=com\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:68
+msgid ""
 "\n"
-"For more information, see the FreeIPA Documentation to Sudo.\n"
+" Create a new rule:\n"
+"   ipa sudorule-add readfiles\n"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:58
+#: ipalib/plugins/sudorule.py:71
+msgid ""
+"\n"
+" Add sudo command object and add it as allowed command in the rule:\n"
+"   ipa sudocmd-add /usr/bin/less\n"
+"   ipa sudorule-add-allow-command readfiles --sudocmds /usr/bin/less\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:75
+msgid ""
+"\n"
+" Add a host to the rule:\n"
+"   ipa sudorule-add-host readfiles --hosts server.example.com\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:78
+msgid ""
+"\n"
+" Add a user to the rule:\n"
+"   ipa sudorule-add-user readfiles --users jsmith\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:81
+msgid ""
+"\n"
+" Add a special Sudo rule for default Sudo server configuration:\n"
+"   ipa sudorule-add defaults\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:84
+msgid ""
+"\n"
+" Set a default Sudo option:\n"
+"   ipa sudorule-add-option defaults --sudooption '!authenticate'\n"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:91
 msgid "Commands for controlling sudo configuration"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:61
+#: ipalib/plugins/sudorule.py:97
 msgid "this option has been deprecated."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:77
+#: ipalib/plugins/sudorule.py:101
+msgid "host masks of allowed hosts"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:124
 msgid "sudo rule"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:78
+#: ipalib/plugins/sudorule.py:125
 msgid "sudo rules"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:100
+#: ipalib/plugins/sudorule.py:212
 msgid "Sudo Rules"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:101
+#: ipalib/plugins/sudorule.py:213
 msgid "Sudo Rule"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:131
+#: ipalib/plugins/sudorule.py:243
 msgid "Command category"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:132
+#: ipalib/plugins/sudorule.py:244
 msgid "Command category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:137
+#: ipalib/plugins/sudorule.py:249
 msgid "RunAs User category"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:138
+#: ipalib/plugins/sudorule.py:250
 msgid "RunAs User category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:143
+#: ipalib/plugins/sudorule.py:255
 msgid "RunAs Group category"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:144
+#: ipalib/plugins/sudorule.py:256
 msgid "RunAs Group category the rule applies to"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:149
+#: ipalib/plugins/sudorule.py:261
 msgid "Sudo order"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:150
+#: ipalib/plugins/sudorule.py:262
 msgid "integer to order the Sudo rules"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:171
+#: ipalib/plugins/sudorule.py:276
+msgid "External User"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:277
+msgid "External User the rule applies to (sudorule-find only)"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:289
+msgid "Host Masks"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:295
 msgid "Sudo Allow Commands"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:175
+#: ipalib/plugins/sudorule.py:299
 msgid "Sudo Deny Commands"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:179
+#: ipalib/plugins/sudorule.py:303
 msgid "Sudo Allow Command Groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:183
+#: ipalib/plugins/sudorule.py:307
 msgid "Sudo Deny Command Groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:187
+#: ipalib/plugins/sudorule.py:311
 msgid "RunAs Users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:188
+#: ipalib/plugins/sudorule.py:312
 msgid "Run as a user"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:192
+#: ipalib/plugins/sudorule.py:316
 msgid "Groups of RunAs Users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:193
+#: ipalib/plugins/sudorule.py:317
 msgid "Run as any user within a specified group"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:198
-msgid "External User"
+#: ipalib/plugins/sudorule.py:322
+msgid "RunAs External User"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:199
-msgid "External User the rule applies to (sudorule-find only)"
+#: ipalib/plugins/sudorule.py:323
+msgid "External User the commands can run as (sudorule-find only)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:203
-msgid "RunAs External User"
+#: ipalib/plugins/sudorule.py:327
+msgid "External Groups of RunAs Users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:204
-msgid "External User the commands can run as (sudorule-find only)"
+#: ipalib/plugins/sudorule.py:328
+msgid "External Groups of users that the command can run as"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:208
-msgid "RunAs External Group"
+#: ipalib/plugins/sudorule.py:332
+msgid "RunAs Groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:209
-msgid "External Group the commands can run as (sudorule-find only)"
+#: ipalib/plugins/sudorule.py:333
+msgid "Run with the gid of a specified POSIX group"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:212 ipalib/plugins/sudorule.py:612
-#: ipalib/plugins/sudorule.py:665
-msgid "Sudo Option"
+#: ipalib/plugins/sudorule.py:338
+msgid "RunAs External Group"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:216
-msgid "RunAs Groups"
+#: ipalib/plugins/sudorule.py:339
+msgid "External Group the commands can run as (sudorule-find only)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:217
-msgid "Run with the gid of a specified POSIX group"
+#: ipalib/plugins/sudorule.py:342 ipalib/plugins/sudorule.py:915
+#: ipalib/plugins/sudorule.py:968
+msgid "Sudo Option"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:224
+#: ipalib/plugins/sudorule.py:348
 #, python-format
 msgid "order must be a unique value (%(order)d already used by %(rule)s)"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:246
+#: ipalib/plugins/sudorule.py:370
 msgid "Create new Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:255
+#: ipalib/plugins/sudorule.py:379
 #, python-format
 msgid "Added Sudo Rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:261
+#: ipalib/plugins/sudorule.py:384
 msgid "Delete Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:263
+#: ipalib/plugins/sudorule.py:386
 #, python-format
 msgid "Deleted Sudo Rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:269
+#: ipalib/plugins/sudorule.py:391
 msgid "Modify Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:271
+#: ipalib/plugins/sudorule.py:393
 #, python-format
 msgid "Modified Sudo Rule \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:294
+#: ipalib/plugins/sudorule.py:413
+#, python-format
 msgid ""
-"command category cannot be set to 'all' while there are allow or deny "
-"commands"
+"%(type)s category cannot be set to 'all' while there are allowed %(objects)s"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:419 ipalib/plugins/user.py:228
+msgid "user"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:419 ipalib/plugins/user.py:229
+msgid "users"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:429
+msgid "command"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:429
+msgid "commands"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:435
+msgid "runAs user"
+msgstr ""
+
+#: ipalib/plugins/sudorule.py:435
+msgid "runAs users"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:296
-msgid "user runAs category cannot be set to 'all' while there are users"
+#: ipalib/plugins/sudorule.py:440
+msgid "group runAs"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:298
-msgid "group runAs category cannot be set to 'all' while there are groups"
+#: ipalib/plugins/sudorule.py:440
+msgid "runAs groups"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:306
+#: ipalib/plugins/sudorule.py:458
 msgid "Search for Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:309
+#: ipalib/plugins/sudorule.py:461
 #, python-format
 msgid "%(count)d Sudo Rule matched"
 msgid_plural "%(count)d Sudo Rules matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/sudorule.py:316
+#: ipalib/plugins/sudorule.py:467
 msgid "Display Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:322
+#: ipalib/plugins/sudorule.py:472
 msgid "Enable a Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:340
+#: ipalib/plugins/sudorule.py:493
 #, python-format
 msgid "Enabled Sudo Rule \"%s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:346
+#: ipalib/plugins/sudorule.py:498
 msgid "Disable a Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:364
+#: ipalib/plugins/sudorule.py:519
 #, python-format
 msgid "Disabled Sudo Rule \"%s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:370 ipalib/plugins/sudorule.py:399
+#: ipalib/plugins/sudorule.py:524 ipalib/plugins/sudorule.py:555
 msgid "Add commands and sudo command groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:382 ipalib/plugins/sudorule.py:411
+#: ipalib/plugins/sudorule.py:539
 msgid "commands cannot be added when command category='all'"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:390 ipalib/plugins/sudorule.py:418
+#: ipalib/plugins/sudorule.py:547 ipalib/plugins/sudorule.py:567
 msgid "Remove commands and sudo command groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:427
+#: ipalib/plugins/sudorule.py:575
 msgid "Add users and groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:450
+#: ipalib/plugins/sudorule.py:607
 msgid "Remove users and groups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:463
+#: ipalib/plugins/sudorule.py:625
 msgid "Add hosts and hostgroups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:486
+#: ipalib/plugins/sudorule.py:682
 msgid "Remove hosts and hostgroups affected by Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:498
+#: ipalib/plugins/sudorule.py:727
 msgid "Add users and groups for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:517 ipalib/plugins/sudorule.py:574
+#: ipalib/plugins/sudorule.py:750 ipalib/plugins/sudorule.py:863
 msgid "users cannot be added when runAs user or runAs group category='all'"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:523
+#: ipalib/plugins/sudorule.py:757
 #, python-format
 msgid "RunAsUser does not accept '%(name)s' as a user name"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:529
+#: ipalib/plugins/sudorule.py:765
 #, python-format
 msgid "RunAsUser does not accept '%(name)s' as a group name"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:542
+#: ipalib/plugins/sudorule.py:804
 msgid "Remove users and groups for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:555
+#: ipalib/plugins/sudorule.py:842
 msgid "Add group for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:580
+#: ipalib/plugins/sudorule.py:870
 #, python-format
 msgid "RunAsGroup does not accept '%(name)s' as a group name"
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:593
+#: ipalib/plugins/sudorule.py:890
 msgid "Remove group for Sudo to execute as."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:606
+#: ipalib/plugins/sudorule.py:909
 msgid "Add an option to the Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:649
+#: ipalib/plugins/sudorule.py:953
 #, python-format
 msgid "Added option \"%(option)s\" to Sudo Rule \"%(rule)s\""
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:659
+#: ipalib/plugins/sudorule.py:962
 msgid "Remove an option from Sudo Rule."
 msgstr ""
 
-#: ipalib/plugins/sudorule.py:705
+#: ipalib/plugins/sudorule.py:1011
 #, python-format
 msgid "Removed option \"%(option)s\" from Sudo Rule \"%(rule)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:49
+#: ipalib/plugins/trust.py:50
 msgid ""
 "\n"
 "Cross-realm trusts\n"
@@ -9409,72 +10634,72 @@ msgid ""
 "\"\n"
 msgstr ""
 
-#: ipalib/plugins/trust.py:141
+#: ipalib/plugins/trust.py:144
 msgid "Non-Active Directory domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:143
+#: ipalib/plugins/trust.py:146
 msgid "RFC4120-compliant Kerberos realm"
 msgstr ""
 
-#: ipalib/plugins/trust.py:144
+#: ipalib/plugins/trust.py:147
 msgid "Trusting forest"
 msgstr ""
 
-#: ipalib/plugins/trust.py:145
+#: ipalib/plugins/trust.py:148
 msgid "Trusted forest"
 msgstr ""
 
-#: ipalib/plugins/trust.py:146
+#: ipalib/plugins/trust.py:149
 msgid "Two-way trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:147
+#: ipalib/plugins/trust.py:150
 msgid "Established and verified"
 msgstr ""
 
-#: ipalib/plugins/trust.py:148
+#: ipalib/plugins/trust.py:151
 msgid "Waiting for confirmation by remote side"
 msgstr ""
 
-#: ipalib/plugins/trust.py:149
+#: ipalib/plugins/trust.py:152
 msgid "Unknown"
 msgstr ""
 
-#: ipalib/plugins/trust.py:153
+#: ipalib/plugins/trust.py:156
 msgid "Trust type (ad for Active Directory, default)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:197
+#: ipalib/plugins/trust.py:309
 msgid "trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:198
+#: ipalib/plugins/trust.py:310
 msgid "trusts"
 msgstr ""
 
-#: ipalib/plugins/trust.py:209
+#: ipalib/plugins/trust.py:347
 msgid "Trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:214 ipa-client/ipa-rmkeytab.c:176
+#: ipalib/plugins/trust.py:352 ipa-client/ipa-rmkeytab.c:176
 msgid "Realm name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:228
+#: ipalib/plugins/trust.py:366
 msgid "SID blacklist incoming"
 msgstr ""
 
-#: ipalib/plugins/trust.py:233
+#: ipalib/plugins/trust.py:371
 msgid "SID blacklist outgoing"
 msgstr ""
 
-#: ipalib/plugins/trust.py:250
+#: ipalib/plugins/trust.py:388
 #, python-format
 msgid "invalid SID: %(value)s"
 msgstr ""
 
-#: ipalib/plugins/trust.py:274
+#: ipalib/plugins/trust.py:410
 msgid ""
 "\n"
 "Add new trust to use.\n"
@@ -9491,144 +10716,145 @@ msgid ""
 "    "
 msgstr ""
 
-#: ipalib/plugins/trust.py:298
+#: ipalib/plugins/trust.py:434
 msgid "Active Directory domain administrator"
 msgstr ""
 
-#: ipalib/plugins/trust.py:302
+#: ipalib/plugins/trust.py:438
 msgid "Active directory domain administrator's password"
 msgstr ""
 
-#: ipalib/plugins/trust.py:307
+#: ipalib/plugins/trust.py:443
 msgid "Domain controller for the Active Directory domain (optional)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:311
+#: ipalib/plugins/trust.py:447
 msgid "Shared secret for the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:316
+#: ipalib/plugins/trust.py:452
 msgid "First Posix ID of the range reserved for the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:320
+#: ipalib/plugins/trust.py:456
 msgid "Size of the ID range reserved for the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:325
+#: ipalib/plugins/trust.py:461
+#, python-brace-format
 msgid "Type of trusted domain ID range, one of {vals}"
 msgstr ""
 
-#: ipalib/plugins/trust.py:331
+#: ipalib/plugins/trust.py:467
 #, python-format
 msgid "Added Active Directory trust for realm \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:372 ipalib/plugins/trust.py:414
-#: ipalib/plugins/trust.py:434 ipalib/plugins/trust.py:444
-#: ipalib/plugins/trust.py:671 ipalib/plugins/trust.py:697
-#: ipalib/plugins/trust.py:1230 ipalib/plugins/trust.py:1242
+#: ipalib/plugins/trust.py:468
+#, python-format
+msgid "Re-established trust to domain \"%(value)s\""
+msgstr ""
+
+#: ipalib/plugins/trust.py:517 ipalib/plugins/trust.py:559
+#: ipalib/plugins/trust.py:579 ipalib/plugins/trust.py:589
+#: ipalib/plugins/trust.py:711 ipalib/plugins/trust.py:743
+#: ipalib/plugins/trust.py:1320 ipalib/plugins/trust.py:1332
 msgid "AD Trust setup"
 msgstr ""
 
-#: ipalib/plugins/trust.py:374 ipalib/plugins/trust.py:1232
+#: ipalib/plugins/trust.py:519 ipalib/plugins/trust.py:1322
 msgid ""
 "Cannot perform join operation without Samba 4 support installed. Make sure "
 "you have installed server-trust-ad sub-package of IPA"
 msgstr ""
 
-#: ipalib/plugins/trust.py:382
+#: ipalib/plugins/trust.py:527
 msgid "missing base_id"
 msgstr ""
 
-#: ipalib/plugins/trust.py:384
+#: ipalib/plugins/trust.py:529
 msgid "pysss_murmur is not available on the server and no base-id is given."
 msgstr ""
 
-#: ipalib/plugins/trust.py:390 ipalib/plugins/trust.py:394
+#: ipalib/plugins/trust.py:535 ipalib/plugins/trust.py:539
 msgid "trust type"
 msgstr ""
 
-#: ipalib/plugins/trust.py:395
+#: ipalib/plugins/trust.py:540
 msgid "only \"ad\" is supported"
 msgstr ""
 
-#: ipalib/plugins/trust.py:405
+#: ipalib/plugins/trust.py:550
 msgid "Realm-domain mismatch"
 msgstr ""
 
-#: ipalib/plugins/trust.py:406
+#: ipalib/plugins/trust.py:551
 msgid ""
-"To estabilish trust with Active Directory, the domain name and the realm "
-"name of the IPA server must match"
+"To establish trust with Active Directory, the domain name and the realm name "
+"of the IPA server must match"
 msgstr ""
 
-#: ipalib/plugins/trust.py:436
+#: ipalib/plugins/trust.py:581
 msgid "Trusted domain and administrator account use different realms"
 msgstr ""
 
-#: ipalib/plugins/trust.py:445
+#: ipalib/plugins/trust.py:590
 msgid "Realm administrator password should be specified"
 msgstr ""
 
-#: ipalib/plugins/trust.py:466
+#: ipalib/plugins/trust.py:611
 msgid "id range type"
 msgstr ""
 
-#: ipalib/plugins/trust.py:468
+#: ipalib/plugins/trust.py:613
 msgid ""
 "Only the ipa-ad-trust and ipa-ad-trust-posix are allowed values for --range-"
 "type when adding an AD trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:478
+#: ipalib/plugins/trust.py:623
 msgid "id range"
 msgstr ""
 
-#: ipalib/plugins/trust.py:480
+#: ipalib/plugins/trust.py:625
 msgid ""
 "An id range already exists for this trust. You should either delete the old "
 "range, or exclude --base-id/--range-size options from the command."
 msgstr ""
 
-#: ipalib/plugins/trust.py:502
+#: ipalib/plugins/trust.py:647
 msgid "range exists"
 msgstr ""
 
-#: ipalib/plugins/trust.py:504
+#: ipalib/plugins/trust.py:649
 msgid ""
 "ID range with the same name but different domain SID already exists. The ID "
 "range for the new trusted domain must be created manually."
 msgstr ""
 
-#: ipalib/plugins/trust.py:511
+#: ipalib/plugins/trust.py:656
 msgid "range type change"
 msgstr ""
 
-#: ipalib/plugins/trust.py:512
+#: ipalib/plugins/trust.py:657
 msgid ""
 "ID range for the trusted domain already exists, but it has a different type. "
 "Please remove the old range manually, or do not enforce type via --range-"
 "type option."
 msgstr ""
 
-#: ipalib/plugins/trust.py:631
-#, python-format
-msgid "Re-established trust to domain \"%(value)s\""
-msgstr ""
-
-#: ipalib/plugins/trust.py:646
+#: ipalib/plugins/trust.py:686
 #, python-format
 msgid "Unable to resolve domain controller for '%s' domain. "
 msgstr ""
 
-#: ipalib/plugins/trust.py:652
+#: ipalib/plugins/trust.py:692
 msgid ""
 "Forward policy is defined for it in IPA DNS, perhaps forwarder points to "
 "incorrect host?"
 msgstr ""
 
-#: ipalib/plugins/trust.py:655
+#: ipalib/plugins/trust.py:695
 #, python-format
 msgid ""
 "IPA manages DNS, please verify your DNS configuration and make sure that "
@@ -9637,31 +10863,31 @@ msgid ""
 "documentation. "
 msgstr ""
 
-#: ipalib/plugins/trust.py:665
+#: ipalib/plugins/trust.py:705
 #, python-format
 msgid ""
 "Since IPA does not manage DNS records, ensure DNS is configured to resolve "
 "'%(domain)s' domain from IPA hosts and back."
 msgstr ""
 
-#: ipalib/plugins/trust.py:672
+#: ipalib/plugins/trust.py:712
 msgid "Unable to verify write permissions to the AD"
 msgstr ""
 
-#: ipalib/plugins/trust.py:698
+#: ipalib/plugins/trust.py:744
 msgid "Not enough arguments specified to perform trust setup"
 msgstr ""
 
-#: ipalib/plugins/trust.py:701
+#: ipalib/plugins/trust.py:748
 msgid "Delete a trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:703
+#: ipalib/plugins/trust.py:750
 #, python-format
 msgid "Deleted trust \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:706
+#: ipalib/plugins/trust.py:754
 msgid ""
 "\n"
 "    Modify a trust (for future use).\n"
@@ -9671,199 +10897,203 @@ msgid ""
 "    "
 msgstr ""
 
-#: ipalib/plugins/trust.py:713
+#: ipalib/plugins/trust.py:761
 #, python-format
 msgid "Modified trust \"%(value)s\" (change will be effective in 60 seconds)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:724
+#: ipalib/plugins/trust.py:773
 msgid "Search for trusts."
 msgstr ""
 
-#: ipalib/plugins/trust.py:729
+#: ipalib/plugins/trust.py:778
 #, python-format
 msgid "%(count)d trust matched"
 msgid_plural "%(count)d trusts matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/trust.py:755
+#: ipalib/plugins/trust.py:804
 msgid "Display information about a trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:792
+#: ipalib/plugins/trust.py:839
 msgid "trust configuration"
 msgstr ""
 
-#: ipalib/plugins/trust.py:798 ipalib/plugins/trust.py:799
+#: ipalib/plugins/trust.py:845 ipalib/plugins/trust.py:846
 msgid "Global Trust Configuration"
 msgstr ""
 
-#: ipalib/plugins/trust.py:807
+#: ipalib/plugins/trust.py:854
 msgid "Security Identifier"
 msgstr ""
 
-#: ipalib/plugins/trust.py:811
+#: ipalib/plugins/trust.py:858
 msgid "NetBIOS name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:815
+#: ipalib/plugins/trust.py:862
 msgid "Domain GUID"
 msgstr ""
 
-#: ipalib/plugins/trust.py:820
+#: ipalib/plugins/trust.py:867
 msgid "Fallback primary group"
 msgstr ""
 
-#: ipalib/plugins/trust.py:832
+#: ipalib/plugins/trust.py:879
 msgid "unsupported trust type"
 msgstr ""
 
-#: ipalib/plugins/trust.py:895
+#: ipalib/plugins/trust.py:942
 msgid "Modify global trust configuration."
 msgstr ""
 
-#: ipalib/plugins/trust.py:898
+#: ipalib/plugins/trust.py:945
 #, python-format
 msgid "Modified \"%(value)s\" trust configuration"
 msgstr ""
 
-#: ipalib/plugins/trust.py:917
+#: ipalib/plugins/trust.py:964
 msgid "Show global trust configuration."
 msgstr ""
 
-#: ipalib/plugins/trust.py:943
+#: ipalib/plugins/trust.py:991
 msgid "Resolve security identifiers of users and groups in trusted domains"
 msgstr ""
 
-#: ipalib/plugins/trust.py:947
+#: ipalib/plugins/trust.py:995
 msgid "Security Identifiers (SIDs)"
 msgstr ""
 
-#: ipalib/plugins/trust.py:953
+#: ipalib/plugins/trust.py:1001
 msgid "Name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:954
+#: ipalib/plugins/trust.py:1002
 msgid "SID"
 msgstr ""
 
-#: ipalib/plugins/trust.py:985
+#: ipalib/plugins/trust.py:1033
 msgid "Determine whether ipa-adtrust-install has been run on this system"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1012
+#: ipalib/plugins/trust.py:1060
 msgid ""
 "Determine whether Schema Compatibility plugin is configured to serve trusted "
 "domain users and groups"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1065
+#: ipalib/plugins/trust.py:1113
 msgid "Determine whether ipa-adtrust-install has been run with sidgen task"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1081
+#: ipalib/plugins/trust.py:1129
 msgid "sidgen_was_run"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1083
+#: ipalib/plugins/trust.py:1131
 msgid ""
 "This command relies on the existence of the \"editors\" group, but this "
 "group was not found."
 msgstr ""
 
-#: ipalib/plugins/trust.py:1102
+#: ipalib/plugins/trust.py:1150
 msgid "trust domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1103
+#: ipalib/plugins/trust.py:1151
 msgid "trust domains"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1108
+#: ipalib/plugins/trust.py:1156
 msgid "Trusted domains"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1109
+#: ipalib/plugins/trust.py:1157
 msgid "Trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1113
+#: ipalib/plugins/trust.py:1161
 msgid "Domain name"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1126
+#: ipalib/plugins/trust.py:1174
 msgid "Trusted domain partner"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1146
+#: ipalib/plugins/trust.py:1194
 msgid "Search domains of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1153
+#: ipalib/plugins/trust.py:1197
+msgid "Domain enabled"
+msgstr ""
+
+#: ipalib/plugins/trust.py:1224
 msgid "Modify trustdomain of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1160
+#: ipalib/plugins/trust.py:1231
 msgid "Allow access from the trusted domain"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1171
+#: ipalib/plugins/trust.py:1242
 msgid "Remove infromation about the domain associated with the trust."
 msgstr ""
 
-#: ipalib/plugins/trust.py:1173
+#: ipalib/plugins/trust.py:1244
 #, python-format
 msgid "Removed information about the trusted domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:1182
+#: ipalib/plugins/trust.py:1253
 msgid ""
 "cannot delete root domain of the trust, use trust-del to delete the trust "
 "itself"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1223
+#: ipalib/plugins/trust.py:1313
 msgid "Refresh list of the domains associated with the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1253
+#: ipalib/plugins/trust.py:1343
 msgid "List of trust domains successfully refreshed"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1255
+#: ipalib/plugins/trust.py:1345
 msgid "No new trust domains were found"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1265
+#: ipalib/plugins/trust.py:1355
 msgid "Allow use of IPA resources by the domain of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1268
+#: ipalib/plugins/trust.py:1358
 #, python-format
 msgid "Enabled trust domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:1275
+#: ipalib/plugins/trust.py:1365
 msgid "Root domain of the trust is always enabled for the existing trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1305
+#: ipalib/plugins/trust.py:1395
 msgid "Disable use of IPA resources by the domain of the trust"
 msgstr ""
 
-#: ipalib/plugins/trust.py:1308
+#: ipalib/plugins/trust.py:1398
 #, python-format
 msgid "Disabled trust domain \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/trust.py:1315
+#: ipalib/plugins/trust.py:1405
 msgid ""
 "cannot disable root domain of the trust, use trust-del to delete the trust "
 "itself"
 msgstr ""
 
-#: ipalib/plugins/user.py:41
+#: ipalib/plugins/user.py:43
 msgid ""
 "\n"
 "Users\n"
@@ -9909,250 +11139,276 @@ msgid ""
 "   ipa user-del tuser1\n"
 msgstr ""
 
-#: ipalib/plugins/user.py:89
+#: ipalib/plugins/user.py:92
 msgid "Kerberos keys available"
 msgstr ""
 
-#: ipalib/plugins/user.py:98
-msgid "Server"
-msgstr ""
-
-#: ipalib/plugins/user.py:101
+#: ipalib/plugins/user.py:104
 msgid "Failed logins"
 msgstr ""
 
-#: ipalib/plugins/user.py:104
+#: ipalib/plugins/user.py:107
 msgid "Last successful authentication"
 msgstr ""
 
-#: ipalib/plugins/user.py:107
+#: ipalib/plugins/user.py:110
 msgid "Last failed authentication"
 msgstr ""
 
-#: ipalib/plugins/user.py:110
+#: ipalib/plugins/user.py:113
 msgid "Time now"
 msgstr ""
 
-#: ipalib/plugins/user.py:125
+#: ipalib/plugins/user.py:134
 msgid "must be TRUE or FALSE"
 msgstr ""
 
-#: ipalib/plugins/user.py:197
-msgid "user"
-msgstr ""
-
-#: ipalib/plugins/user.py:198
-msgid "users"
-msgstr ""
-
-#: ipalib/plugins/user.py:234
+#: ipalib/plugins/user.py:438
 msgid "User login"
 msgstr ""
 
-#: ipalib/plugins/user.py:241
+#: ipalib/plugins/user.py:445
 msgid "First name"
 msgstr ""
 
-#: ipalib/plugins/user.py:245
+#: ipalib/plugins/user.py:449
 msgid "Last name"
 msgstr ""
 
-#: ipalib/plugins/user.py:248
+#: ipalib/plugins/user.py:452
 msgid "Full name"
 msgstr ""
 
-#: ipalib/plugins/user.py:253
+#: ipalib/plugins/user.py:457
 msgid "Display name"
 msgstr ""
 
-#: ipalib/plugins/user.py:258
+#: ipalib/plugins/user.py:462
 msgid "Initials"
 msgstr ""
 
-#: ipalib/plugins/user.py:264
+#: ipalib/plugins/user.py:468
 msgid "Home directory"
 msgstr ""
 
-#: ipalib/plugins/user.py:267
+#: ipalib/plugins/user.py:471
 msgid "GECOS"
 msgstr ""
 
-#: ipalib/plugins/user.py:273
+#: ipalib/plugins/user.py:477
 msgid "Login shell"
 msgstr ""
 
-#: ipalib/plugins/user.py:277
+#: ipalib/plugins/user.py:481
 msgid "Kerberos principal"
 msgstr ""
 
-#: ipalib/plugins/user.py:285
+#: ipalib/plugins/user.py:489
+msgid "Kerberos principal expiration"
+msgstr ""
+
+#: ipalib/plugins/user.py:493
 msgid "Email address"
 msgstr ""
 
-#: ipalib/plugins/user.py:290
+#: ipalib/plugins/user.py:498
 msgid "Prompt to set the user password"
 msgstr ""
 
-#: ipalib/plugins/user.py:296
+#: ipalib/plugins/user.py:504
 msgid "Generate a random user password"
 msgstr ""
 
-#: ipalib/plugins/user.py:306
+#: ipalib/plugins/user.py:514
 msgid "UID"
 msgstr ""
 
-#: ipalib/plugins/user.py:307
+#: ipalib/plugins/user.py:515
 msgid "User ID Number (system will assign one if not provided)"
 msgstr ""
 
-#: ipalib/plugins/user.py:312
+#: ipalib/plugins/user.py:520
 msgid "Group ID Number"
 msgstr ""
 
-#: ipalib/plugins/user.py:317
+#: ipalib/plugins/user.py:525
 msgid "Street address"
 msgstr ""
 
-#: ipalib/plugins/user.py:321
+#: ipalib/plugins/user.py:529
 msgid "City"
 msgstr ""
 
-#: ipalib/plugins/user.py:325
+#: ipalib/plugins/user.py:533
 msgid "State/Province"
 msgstr ""
 
-#: ipalib/plugins/user.py:328
+#: ipalib/plugins/user.py:536
 msgid "ZIP"
 msgstr ""
 
-#: ipalib/plugins/user.py:332
+#: ipalib/plugins/user.py:540
 msgid "Telephone Number"
 msgstr ""
 
-#: ipalib/plugins/user.py:335
+#: ipalib/plugins/user.py:543
 msgid "Mobile Telephone Number"
 msgstr ""
 
-#: ipalib/plugins/user.py:338
+#: ipalib/plugins/user.py:546
 msgid "Pager Number"
 msgstr ""
 
-#: ipalib/plugins/user.py:342
+#: ipalib/plugins/user.py:550
 msgid "Fax Number"
 msgstr ""
 
-#: ipalib/plugins/user.py:346
+#: ipalib/plugins/user.py:554
 msgid "Org. Unit"
 msgstr ""
 
-#: ipalib/plugins/user.py:349
+#: ipalib/plugins/user.py:557
 msgid "Job Title"
 msgstr ""
 
-#: ipalib/plugins/user.py:352
-msgid "Manager"
-msgstr ""
-
-#: ipalib/plugins/user.py:355
+#: ipalib/plugins/user.py:563
 msgid "Car License"
 msgstr ""
 
-#: ipalib/plugins/user.py:358
+#: ipalib/plugins/user.py:566
 msgid "Account disabled"
 msgstr ""
 
-#: ipalib/plugins/user.py:385 ipalib/plugins/user.py:389
+#: ipalib/plugins/user.py:578
+msgid "User authentication types"
+msgstr ""
+
+#: ipalib/plugins/user.py:579
+msgid "Types of supported user authentication"
+msgstr ""
+
+#: ipalib/plugins/user.py:586
+msgid ""
+"User category (semantics placed on this attribute are for local "
+"interpretation)"
+msgstr ""
+
+#: ipalib/plugins/user.py:591
+msgid "RADIUS proxy configuration"
+msgstr ""
+
+#: ipalib/plugins/user.py:595
+msgid "RADIUS proxy username"
+msgstr ""
+
+#: ipalib/plugins/user.py:598
+msgid "Department Number"
+msgstr ""
+
+#: ipalib/plugins/user.py:601
+msgid "Employee Number"
+msgstr ""
+
+#: ipalib/plugins/user.py:604
+msgid "Employee Type"
+msgstr ""
+
+#: ipalib/plugins/user.py:607
+msgid "Preferred Language"
+msgstr ""
+
+#: ipalib/plugins/user.py:629 ipalib/plugins/user.py:633
 #, python-format
 msgid "invalid e-mail format: %(email)s"
 msgstr ""
 
-#: ipalib/plugins/user.py:415
+#: ipalib/plugins/user.py:659
 #, python-format
 msgid "manager %(manager)s not found"
 msgstr ""
 
-#: ipalib/plugins/user.py:434
+#: ipalib/plugins/user.py:677
 msgid "Add a new user."
 msgstr ""
 
-#: ipalib/plugins/user.py:436
+#: ipalib/plugins/user.py:679
 #, python-format
 msgid "Added user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:443
+#: ipalib/plugins/user.py:686
 msgid "Don't create user private group"
 msgstr ""
 
-#: ipalib/plugins/user.py:487 ipalib/plugins/user.py:623
+#: ipalib/plugins/user.py:730 ipalib/plugins/user.py:891
 #, python-format
 msgid "can be at most %(len)d characters"
 msgstr ""
 
-#: ipalib/plugins/user.py:522
+#: ipalib/plugins/user.py:762
 msgid "Default group for new users is not POSIX"
 msgstr ""
 
-#: ipalib/plugins/user.py:596
+#: ipalib/plugins/user.py:852
 msgid "Delete a user."
 msgstr ""
 
-#: ipalib/plugins/user.py:598
+#: ipalib/plugins/user.py:854
 #, python-format
 msgid "Deleted user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:609
+#: ipalib/plugins/user.py:877
 msgid "Modify a user."
 msgstr ""
 
-#: ipalib/plugins/user.py:611
+#: ipalib/plugins/user.py:879
 #, python-format
 msgid "Modified user \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:664
+#: ipalib/plugins/user.py:950
 msgid "Search for users."
 msgstr ""
 
-#: ipalib/plugins/user.py:671
+#: ipalib/plugins/user.py:957
 msgid "Self"
 msgstr ""
 
-#: ipalib/plugins/user.py:672
+#: ipalib/plugins/user.py:958
 msgid "Display user record for current Kerberos principal"
 msgstr ""
 
-#: ipalib/plugins/user.py:703
+#: ipalib/plugins/user.py:994
 #, python-format
 msgid "%(count)d user matched"
 msgid_plural "%(count)d users matched"
 msgstr[0] ""
 msgstr[1] ""
 
-#: ipalib/plugins/user.py:710
+#: ipalib/plugins/user.py:1000
 msgid "Display information about a user."
 msgstr ""
 
-#: ipalib/plugins/user.py:726
+#: ipalib/plugins/user.py:1016
 msgid "Disable a user account."
 msgstr ""
 
-#: ipalib/plugins/user.py:729
+#: ipalib/plugins/user.py:1019
 #, python-format
 msgid "Disabled user account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:748
+#: ipalib/plugins/user.py:1037
 msgid "Enable a user account."
 msgstr ""
 
-#: ipalib/plugins/user.py:752
+#: ipalib/plugins/user.py:1041
 #, python-format
 msgid "Enabled user account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:769
+#: ipalib/plugins/user.py:1058
 msgid ""
 "\n"
 "    Unlock a user account\n"
@@ -10164,12 +11420,12 @@ msgid ""
 "    an administrator."
 msgstr ""
 
-#: ipalib/plugins/user.py:778
+#: ipalib/plugins/user.py:1067
 #, python-format
 msgid "Unlocked account \"%(value)s\""
 msgstr ""
 
-#: ipalib/plugins/user.py:794
+#: ipalib/plugins/user.py:1087
 msgid ""
 "\n"
 "    Lockout status of a user account\n"
@@ -10198,17 +11454,17 @@ msgid ""
 "    means that the user may attempt a login again. "
 msgstr ""
 
-#: ipalib/plugins/user.py:852
+#: ipalib/plugins/user.py:1145
 #, python-format
 msgid "%(host)s failed: %(error)s"
 msgstr ""
 
-#: ipalib/plugins/user.py:888
+#: ipalib/plugins/user.py:1181
 #, python-format
 msgid "%(host)s failed"
 msgstr ""
 
-#: ipalib/plugins/user.py:898
+#: ipalib/plugins/user.py:1191
 #, python-format
 msgid "Account disabled: %(disabled)s"
 msgstr ""
@@ -10225,107 +11481,100 @@ msgstr ""
 msgid "No such virtual command"
 msgstr ""
 
-#: ipalib/rpc.py:673
+#: ipalib/rpc.py:839
 msgid "any of the configured servers"
 msgstr ""
 
-#: ipalib/session.py:776 ipalib/session.py:879
+#: ipalib/session.py:777 ipalib/session.py:880
 msgid "could not allocate unique new session_id"
 msgstr ""
 
-#: ipalib/util.py:186
+#: ipalib/util.py:191
 msgid "Filename is empty"
 msgstr ""
 
-#: ipalib/util.py:190
+#: ipalib/util.py:195
 #, python-format
 msgid "Permission denied: %(file)s"
 msgstr ""
 
-#: ipalib/util.py:228
-msgid "empty DNS label"
-msgstr ""
-
-#: ipalib/util.py:231
+#: ipalib/util.py:243
 msgid "DNS label cannot be longer that 63 characters"
 msgstr ""
 
-#: ipalib/util.py:234
+#: ipalib/util.py:248
 #, python-format
 msgid ""
-"only letters, numbers,%(underscore)s and - are allowed. DNS label may not "
-"start or end with -"
+"only letters, numbers, %(chars)s are allowed. DNS label may not start or end "
+"with %(chars2)s"
 msgstr ""
 
-#: ipalib/util.py:252
-msgid ""
-"mail account may only include letters, numbers, -, _ and a dot. There may "
-"not be consecutive -, _ and . characters. Its parts may not start or end "
-"with - or _"
-msgstr ""
-
-#: ipalib/util.py:258 ipalib/util.py:297
-msgid "cannot be longer that 255 characters"
-msgstr ""
-
-#: ipalib/util.py:266
+#: ipalib/util.py:268
 msgid "too many '@' characters"
 msgstr ""
 
-#: ipalib/util.py:279
+#: ipalib/util.py:270
 msgid "missing address domain"
 msgstr ""
 
-#: ipalib/util.py:284
+#: ipalib/util.py:272
 msgid "missing mail account"
 msgstr ""
 
-#: ipalib/util.py:303
+#: ipalib/util.py:286
+msgid "cannot be longer that 255 characters"
+msgstr ""
+
+#: ipalib/util.py:292
 msgid "hostname contains empty label (consecutive dots)"
 msgstr ""
 
-#: ipalib/util.py:307
+#: ipalib/util.py:296
 msgid "not fully qualified"
 msgstr ""
 
-#: ipalib/util.py:319 ipalib/util.py:325
+#: ipalib/util.py:308 ipalib/util.py:314
 msgid "invalid SSH public key"
 msgstr ""
 
-#: ipalib/util.py:328
+#: ipalib/util.py:317
 msgid "options are not allowed"
 msgstr ""
 
-#: ipalib/x509.py:207
+#: ipalib/util.py:553
+msgid "invalid hostmask"
+msgstr ""
+
+#: ipalib/x509.py:208
 msgid "improperly formatted DER-encoded certificate"
 msgstr ""
 
-#: ipalib/x509.py:244
+#: ipalib/x509.py:245
 #, python-format
 msgid "Issuer \"%(issuer)s\" does not match the expected issuer"
 msgstr ""
 
-#: ipapython/dogtag.py:176
+#: ipapython/dogtag.py:181
 #, python-format
 msgid "Retrieving CA cert chain failed: %s"
 msgstr ""
 
-#: ipapython/dogtag.py:182
+#: ipapython/dogtag.py:187
 #, python-format
 msgid "request failed with HTTP status %d"
 msgstr ""
 
-#: ipapython/dogtag.py:205 ipapython/dogtag.py:212
+#: ipapython/dogtag.py:214 ipapython/dogtag.py:221
 #, python-format
 msgid "Retrieving CA status failed: %s"
 msgstr ""
 
-#: ipapython/ipaldap.py:1000
+#: ipapython/ipaldap.py:1229
 #, python-format
 msgid "objectclass %s not found"
 msgstr ""
 
-#: ipaserver/dcerpc.py:59
+#: ipaserver/dcerpc.py:60
 msgid ""
 "\n"
 "Classes to manage trust joins using DCE-RPC calls\n"
@@ -10334,136 +11583,142 @@ msgid ""
 "and Samba4 python bindings.\n"
 msgstr ""
 
-#: ipaserver/dcerpc.py:76
+#: ipaserver/dcerpc.py:77
 msgid "CIFS server denied your credentials"
 msgstr ""
 
-#: ipaserver/dcerpc.py:79
+#: ipaserver/dcerpc.py:80
 msgid "communication with CIFS server was unsuccessful"
 msgstr ""
 
-#: ipaserver/dcerpc.py:84
+#: ipaserver/dcerpc.py:85
 msgid "AD domain controller"
 msgstr ""
 
-#: ipaserver/dcerpc.py:84
+#: ipaserver/dcerpc.py:85
 msgid "unsupported functional level"
 msgstr ""
 
-#: ipaserver/dcerpc.py:89
+#: ipaserver/dcerpc.py:88
+msgid ""
+"AD domain controller complains about communication sequence. It may mean "
+"unsynchronized time on both sides, for example"
+msgstr ""
+
+#: ipaserver/dcerpc.py:93
 msgid "Cannot find specified domain or server name"
 msgstr ""
 
-#: ipaserver/dcerpc.py:91
+#: ipaserver/dcerpc.py:95
 msgid "At least the domain or IP address should be specified"
 msgstr ""
 
-#: ipaserver/dcerpc.py:103
+#: ipaserver/dcerpc.py:107
 #, python-format
 msgid ""
 "CIFS server communication error: code \"%(num)s\",\n"
 "                  message \"%(message)s\" (both may be \"None\")"
 msgstr ""
 
-#: ipaserver/dcerpc.py:203
+#: ipaserver/dcerpc.py:207
 msgid "no trusted domain is configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:210
+#: ipaserver/dcerpc.py:214
 msgid "domain is not configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:217
+#: ipaserver/dcerpc.py:221
 msgid "SID is not valid"
 msgstr ""
 
-#: ipaserver/dcerpc.py:232
+#: ipaserver/dcerpc.py:236
 msgid "SID does not match exactlywith any trusted domain's SID"
 msgstr ""
 
-#: ipaserver/dcerpc.py:243
+#: ipaserver/dcerpc.py:247
 msgid "SID does not match any trusted domain"
 msgstr ""
 
-#: ipaserver/dcerpc.py:283 ipaserver/dcerpc.py:289 ipaserver/dcerpc.py:511
+#: ipaserver/dcerpc.py:287 ipaserver/dcerpc.py:293 ipaserver/dcerpc.py:515
 msgid "Trust setup"
 msgstr ""
 
-#: ipaserver/dcerpc.py:284
+#: ipaserver/dcerpc.py:288
 msgid "Our domain is not configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:290
+#: ipaserver/dcerpc.py:294
 msgid "No trusted domain is not configured"
 msgstr ""
 
-#: ipaserver/dcerpc.py:295 ipaserver/dcerpc.py:310 ipaserver/dcerpc.py:327
-#: ipaserver/dcerpc.py:339 ipaserver/dcerpc.py:346 ipaserver/dcerpc.py:391
+#: ipaserver/dcerpc.py:299 ipaserver/dcerpc.py:314 ipaserver/dcerpc.py:331
+#: ipaserver/dcerpc.py:343 ipaserver/dcerpc.py:350 ipaserver/dcerpc.py:395
 msgid "trusted domain object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:296
+#: ipaserver/dcerpc.py:300
 msgid "domain is not trusted"
 msgstr ""
 
-#: ipaserver/dcerpc.py:311
+#: ipaserver/dcerpc.py:315
 msgid "no trusted domain matched the specified flat name"
 msgstr ""
 
-#: ipaserver/dcerpc.py:313
+#: ipaserver/dcerpc.py:317
 msgid "trusted domain object not found"
 msgstr ""
 
-#: ipaserver/dcerpc.py:328 ipaserver/dcerpc.py:392
+#: ipaserver/dcerpc.py:332 ipaserver/dcerpc.py:396
 msgid "Ambiguous search, user domain was not specified"
 msgstr ""
 
-#: ipaserver/dcerpc.py:340
+#: ipaserver/dcerpc.py:344
 msgid "Trusted domain did not return a unique object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:347
+#: ipaserver/dcerpc.py:351
 msgid "Trusted domain did not return a valid SID for the object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:377 ipaserver/dcerpc.py:387
+#: ipaserver/dcerpc.py:381 ipaserver/dcerpc.py:391
 msgid "trusted domain user not found"
 msgstr ""
 
-#: ipaserver/dcerpc.py:512
+#: ipaserver/dcerpc.py:516
 msgid "Cannot retrieve trusted domain GC list"
 msgstr ""
 
-#: ipaserver/dcerpc.py:648
+#: ipaserver/dcerpc.py:652
 msgid "CIFS credentials object"
 msgstr ""
 
-#: ipaserver/dcerpc.py:681
+#: ipaserver/dcerpc.py:685
 #, python-format
 msgid "CIFS server %(host)s denied your credentials"
 msgstr ""
 
-#: ipaserver/dcerpc.py:685
+#: ipaserver/dcerpc.py:689
 #, python-format
 msgid "Cannot establish LSA connection to %(host)s. Is CIFS server running?"
 msgstr ""
 
-#: ipaserver/dcerpc.py:874
+#: ipaserver/dcerpc.py:878
 #, python-format
 msgid ""
 "the IPA server and the remote domain cannot share the same NetBIOS name: %s"
 msgstr ""
 
-#: ipaserver/install/certs.py:640
+#: ipaserver/install/certs.py:641
 #, python-format
 msgid "Unable to communicate with CMS (%s)"
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:1252
+#: ipaserver/plugins/dogtag.py:1253
 msgid "Unable to communicate with CMS"
 msgstr ""
 
-#: ipaserver/plugins/dogtag.py:1834
+#: ipaserver/plugins/dogtag.py:1833
 msgid "find not supported on CAs upgraded from 9 to 10"
 msgstr ""
 
@@ -10490,31 +11745,35 @@ msgid ""
 "'%s'."
 msgstr ""
 
-#: ipaserver/rpcserver.py:538
+#: ipaserver/plugins/ldap2.py:323
+msgid "Could not read UPG Definition originfilter. Check your permissions."
+msgstr ""
+
+#: ipaserver/rpcserver.py:475
 msgid "Request must be a dict"
 msgstr ""
 
-#: ipaserver/rpcserver.py:540
+#: ipaserver/rpcserver.py:477
 msgid "Request is missing \"method\""
 msgstr ""
 
-#: ipaserver/rpcserver.py:542
+#: ipaserver/rpcserver.py:479
 msgid "Request is missing \"params\""
 msgstr ""
 
-#: ipaserver/rpcserver.py:548
+#: ipaserver/rpcserver.py:485
 msgid "params must be a list"
 msgstr ""
 
-#: ipaserver/rpcserver.py:550
+#: ipaserver/rpcserver.py:487
 msgid "params must contain [args, options]"
 msgstr ""
 
-#: ipaserver/rpcserver.py:553
+#: ipaserver/rpcserver.py:490
 msgid "params[0] (aka args) must be a list"
 msgstr ""
 
-#: ipaserver/rpcserver.py:556
+#: ipaserver/rpcserver.py:493
 msgid "params[1] (aka options) must be a dict"
 msgstr ""
 
@@ -10538,236 +11797,337 @@ msgstr ""
 msgid "read error\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:61
+#: ipa-client/ipa-getkeytab.c:62
 #, c-format
 msgid "Kerberos context initialization failed: %1$s (%2$d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:72
+#: ipa-client/ipa-getkeytab.c:73
 #, c-format
 msgid "Unable to parse principal: %1$s (%2$d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:127
+#: ipa-client/ipa-getkeytab.c:128
 #, c-format
 msgid "No keys accepted by KDC\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:142
+#: ipa-client/ipa-getkeytab.c:143
 #, c-format
 msgid "Out of memory \n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:181
+#: ipa-client/ipa-getkeytab.c:169
 #, c-format
-msgid "Out of Memory!\n"
+msgid "Unable to set LDAP_OPT_X_TLS_CERTIFICATE\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:175
+#, c-format
+msgid "Unable to init for ldaps(636) connection\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:182
+#, c-format
+msgid "Unable to set LDAP_OPT_X_TLS\n"
 msgstr ""
 
 #: ipa-client/ipa-getkeytab.c:188
 #, c-format
-msgid "Failed to create control!\n"
+msgid "Unable to init for ldap(389) connection\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:212
+#: ipa-client/ipa-getkeytab.c:194
 #, c-format
 msgid "Unable to initialize ldap library!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:220 ipa-client/ipa-join.c:240
+#: ipa-client/ipa-getkeytab.c:202 ipa-client/ipa-join.c:240
 #, c-format
 msgid "Unable to set LDAP_OPT_X_SASL_NOCANON\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:228
+#: ipa-client/ipa-getkeytab.c:210
 #, c-format
-msgid "Unable to set ldap options!\n"
+msgid "Unable to set LDAP_OPT_PROTOCOL_VERSION\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:241
+#: ipa-client/ipa-getkeytab.c:221
 #, c-format
 msgid "Simple bind failed\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:273 ipa-client/ipa-getkeytab.c:286
-#: ipa-client/ipa-getkeytab.c:293 ipa-client/ipa-getkeytab.c:300
+#: ipa-client/ipa-getkeytab.c:264
 #, c-format
 msgid "Operation failed! %s\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:306 ipa-client/ipa-getkeytab.c:316
+#: ipa-client/ipa-getkeytab.c:273
+#, c-format
+msgid "Failed to get result! %s\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:279
+#, c-format
+msgid "Failed to parse extended result! %s\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:286
+#, c-format
+msgid "Failed to parse result! %s\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:304
+#, c-format
+msgid "Missing reply control list!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:314
 #, c-format
 msgid "Missing reply control!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:323
+#: ipa-client/ipa-getkeytab.c:342
+#, c-format
+msgid "Out of Memory!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:349 ipa-client/ipa-getkeytab.c:595
+#, c-format
+msgid "Failed to create control!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:355 ipa-client/ipa-getkeytab.c:602
+#, c-format
+msgid "Failed to bind to server!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:362
+#, c-format
+msgid "Failed to get keytab!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:371
 #, c-format
 msgid "ber_init() failed, Invalid control ?!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:342
+#: ipa-client/ipa-getkeytab.c:390
 #, c-format
 msgid "ber_scanf() failed, unable to find kvno ?!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:354
+#: ipa-client/ipa-getkeytab.c:402
 #, c-format
 msgid "Failed to retrieve encryption type type #%d\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:358
+#: ipa-client/ipa-getkeytab.c:406
 #, c-format
 msgid "Failed to retrieve encryption type %1$s (#%2$d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:368
+#: ipa-client/ipa-getkeytab.c:416
 #, c-format
 msgid "Failed to retrieve any keys"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:405
+#: ipa-client/ipa-getkeytab.c:614
+msgid "Failed to find or parse reply control!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:621
+msgid "Failed to parse control head!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:636 ipa-client/ipa-getkeytab.c:656
+#: ipa-client/ipa-getkeytab.c:675 ipa-client/ipa-join.c:408
+#: ipa-client/ipa-join.c:483 ipa-client/ipa-join.c:501
+#: ipa-client/ipa-join.c:602 ipa-client/ipa-join.c:808
+#: ipa-client/ipa-join.c:869 util/ipa_krb5.c:1002 util/ipa_krb5.c:1036
+#, c-format
+msgid "Out of memory!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:647
+msgid "Failed to parse enctype in key data!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:667
+msgid "Failed to parse salt in key data!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:684
+msgid "Failed to parse ending of key data!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:694
+msgid "Failed to parse ending of control!\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:724
 msgid "New Principal Password"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:411
+#: ipa-client/ipa-getkeytab.c:730
 msgid "Verify Principal Password"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:445
+#: ipa-client/ipa-getkeytab.c:765
 msgid "Print as little as possible"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:445
+#: ipa-client/ipa-getkeytab.c:765
 msgid "Output only on errors"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:447
+#: ipa-client/ipa-getkeytab.c:767
 msgid "Contact this specific KDC Server"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:448
+#: ipa-client/ipa-getkeytab.c:768
 msgid "Server Name"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:450 ipa-client/ipa-rmkeytab.c:171
+#: ipa-client/ipa-getkeytab.c:770 ipa-client/ipa-rmkeytab.c:171
 msgid "The principal to get a keytab for (ex: ftp/ftp.example.com@EXAMPLE.COM)"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:451 ipa-client/ipa-rmkeytab.c:172
+#: ipa-client/ipa-getkeytab.c:771 ipa-client/ipa-rmkeytab.c:172
 msgid "Kerberos Service Principal Name"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:453 ipa-client/ipa-rmkeytab.c:174
+#: ipa-client/ipa-getkeytab.c:773 ipa-client/ipa-rmkeytab.c:174
 msgid "File were to store the keytab information"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:454 ipa-client/ipa-rmkeytab.c:174
+#: ipa-client/ipa-getkeytab.c:774 ipa-client/ipa-rmkeytab.c:174
 msgid "Keytab File Name"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:456
+#: ipa-client/ipa-getkeytab.c:776
 msgid "Encryption types to request"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:457
+#: ipa-client/ipa-getkeytab.c:777
 msgid "Comma separated encryption types list"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:459
+#: ipa-client/ipa-getkeytab.c:779
 msgid "Show the list of permitted encryption types and exit"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:460
+#: ipa-client/ipa-getkeytab.c:780
 msgid "Permitted Encryption Types"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:462
+#: ipa-client/ipa-getkeytab.c:782
 msgid "Asks for a non-random password to use for the principal"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:464
+#: ipa-client/ipa-getkeytab.c:784
 msgid "LDAP DN"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:464
+#: ipa-client/ipa-getkeytab.c:784
 msgid "DN to bind as if not using kerberos"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:466
+#: ipa-client/ipa-getkeytab.c:786
 msgid "LDAP password"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:466
+#: ipa-client/ipa-getkeytab.c:786
 msgid "password to use if not using kerberos"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:491 ipa-client/ipa-rmkeytab.c:190
+#: ipa-client/ipa-getkeytab.c:788
+msgid "Retrieve current keys without changing them"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:813 ipa-client/ipa-rmkeytab.c:190
 #, c-format
 msgid "Kerberos context initialization failed\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:504 util/ipa_krb5.c:792
+#: ipa-client/ipa-getkeytab.c:826 util/ipa_krb5.c:874
 #, c-format
 msgid "No system preferred enctypes ?!\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:507
+#: ipa-client/ipa-getkeytab.c:829
 #, c-format
 msgid "Supported encryption types:\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:511
+#: ipa-client/ipa-getkeytab.c:833
 #, c-format
 msgid "Warning: failed to convert type (#%d)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:530
+#: ipa-client/ipa-getkeytab.c:852
 #, c-format
 msgid "Bind password required when using a bind DN.\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:543
+#: ipa-client/ipa-getkeytab.c:859
+#, c-format
+msgid "Incompatible options provided (-r and -P)\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:870
 #, c-format
 msgid ""
 "Warning: salt types are not honored with randomized passwords (see opt. -P)\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:555
+#: ipa-client/ipa-getkeytab.c:882
 #, c-format
 msgid "Invalid Service Principal Name\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:563
+#: ipa-client/ipa-getkeytab.c:890
 #, c-format
 msgid "Kerberos Credential Cache not found. Do you have a Kerberos Ticket?\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:571
+#: ipa-client/ipa-getkeytab.c:898
 #, c-format
 msgid ""
 "Kerberos User Principal not found. Do you have a valid Credential Cache?\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:579
+#: ipa-client/ipa-getkeytab.c:906
 #, c-format
 msgid "Failed to open Keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:589
+#: ipa-client/ipa-getkeytab.c:921
+#, c-format
+msgid "Retrying with old method\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:929
 #, c-format
 msgid "Failed to create key material\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:608
+#: ipa-client/ipa-getkeytab.c:937
+#, c-format
+msgid "Failed to get keytab\n"
+msgstr ""
+
+#: ipa-client/ipa-getkeytab.c:951
 #, c-format
 msgid "Failed to add key to the keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:617
+#: ipa-client/ipa-getkeytab.c:960
 #, c-format
 msgid "Failed to close the keytab\n"
 msgstr ""
 
-#: ipa-client/ipa-getkeytab.c:623
+#: ipa-client/ipa-getkeytab.c:966
 #, c-format
 msgid "Keytab successfully retrieved and stored in: %s\n"
 msgstr ""
@@ -10833,14 +12193,6 @@ msgstr ""
 msgid "IPA namingContext not found\n"
 msgstr ""
 
-#: ipa-client/ipa-join.c:408 ipa-client/ipa-join.c:483
-#: ipa-client/ipa-join.c:501 ipa-client/ipa-join.c:602
-#: ipa-client/ipa-join.c:808 ipa-client/ipa-join.c:869 util/ipa_krb5.c:973
-#: util/ipa_krb5.c:1007
-#, c-format
-msgid "Out of memory!\n"
-msgstr ""
-
 #: ipa-client/ipa-join.c:419
 #, c-format
 msgid "Search for ipaCertificateSubjectBase failed with error %d"
@@ -11122,35 +12474,35 @@ msgstr ""
 msgid "krb5_kt_close %1$d: %2$s\n"
 msgstr ""
 
-#: util/ipa_krb5.c:800
-msgid "Out of memory!?\n"
-msgstr ""
-
-#: util/ipa_krb5.c:818 util/ipa_krb5.c:833
+#: util/ipa_krb5.c:795 util/ipa_krb5.c:810
 msgid "Out of memory\n"
 msgstr ""
 
-#: util/ipa_krb5.c:847
+#: util/ipa_krb5.c:828
 msgid "Warning unrecognized encryption type.\n"
 msgstr ""
 
-#: util/ipa_krb5.c:861
+#: util/ipa_krb5.c:842
 msgid "Warning unrecognized salt type.\n"
 msgstr ""
 
-#: util/ipa_krb5.c:888
+#: util/ipa_krb5.c:882
+msgid "Out of memory!?\n"
+msgstr ""
+
+#: util/ipa_krb5.c:917
 msgid "Enctype comparison failed!\n"
 msgstr ""
 
-#: util/ipa_krb5.c:953
+#: util/ipa_krb5.c:982
 msgid "Failed to create random key!\n"
 msgstr ""
 
-#: util/ipa_krb5.c:966 util/ipa_krb5.c:984 util/ipa_krb5.c:992
-#: util/ipa_krb5.c:1032
+#: util/ipa_krb5.c:995 util/ipa_krb5.c:1013 util/ipa_krb5.c:1021
+#: util/ipa_krb5.c:1061
 msgid "Failed to create key!\n"
 msgstr ""
 
-#: util/ipa_krb5.c:1018
+#: util/ipa_krb5.c:1047
 msgid "Bad or unsupported salt type.\n"
 msgstr ""
author	Petr Viktorin <pviktori+transifex@redhat.com>	2014-06-27 16:33:47 +0200
committer	Petr Viktorin <pviktori@redhat.com>	2014-06-27 16:40:02 +0200
commit	36d261e843dd6e8197e6f3ea16a97370215b50c2 (patch)
tree	ec77567bd8d5a915cbaebcc16417c167e9b35c63 /install/po/ipa.pot
parent	bd29d3cbbc91bc547fd52e96a8facbdcda91773c (diff)
download	freeipa-36d261e843dd6e8197e6f3ea16a97370215b50c2.tar.gz freeipa-36d261e843dd6e8197e6f3ea16a97370215b50c2.tar.xz freeipa-36d261e843dd6e8197e6f3ea16a97370215b50c2.zip