docs-xml: Document SID extension certificate mappings

Signed-off-by: Jennifer Sutton <jennifersutton@catalyst.net.nz>
Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
Autobuild-User(master): Jennifer Sutton <jsutton@samba.org>
Autobuild-Date(master): Thu Oct 23 01:03:36 UTC 2025 on atb-devel-224

diff --git a/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml b/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml
index e312fbef32a61da90f50004e68669168953ed355..d347e8cdb2c229986dcf24a96ab322b86a1516f4 100644 (file)
--- a/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml
+++ b/docs-xml/smbdotconf/security/kdccertbindingenforcement.xml
@@ -102,6 +102,10 @@
                 <para><emphasis>STRONG</emphasis></para>
             </listitem>
             </itemizedlist>
+
+        Certificate mappings may also take the form of a certificate extension
+        (extension 1.3.6.1.4.1.311.25.2) that contains the user's SID. This is
+        considered a <emphasis>STRONG</emphasis> mapping.
     </para>
 </description>