From: Andreas Schneider <asn@samba.org>
Date: Wed, 14 Feb 2018 11:05:16 +0000 (+0100)
Subject: docs: Add a not that 'wbinfo --user-groups' may be incomplete
X-Git-Tag: tevent-0.9.36~107
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ebd88eb44192a28341579e4a4515bae479e7368a;p=thirdparty%2Fsamba.git

docs: Add a not that 'wbinfo --user-groups' may be incomplete

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Feb 14 20:32:18 CET 2018 on sn-devel-144
---

diff --git a/docs-xml/manpages/wbinfo.1.xml b/docs-xml/manpages/wbinfo.1.xml
index c427007be0f..e2042ca623a 100644
--- a/docs-xml/manpages/wbinfo.1.xml
+++ b/docs-xml/manpages/wbinfo.1.xml
@@ -384,10 +384,35 @@
 
 		<varlistentry>
 		<term>-r|--user-groups <replaceable>username</replaceable></term>
-		<listitem><para>Try to obtain the list of UNIX group ids
-		to which the user belongs.  This only works for users
-		defined on a Domain Controller.
-		</para></listitem>
+		<listitem>
+			<para>
+			Try to obtain the list of UNIX group ids to which the
+			user belongs.  This only works for users defined on a
+			Domain Controller.
+			</para>
+
+			<para>There are two scenaries:</para>
+			<orderedlist>
+				<listitem>
+				<para>
+				User authenticated: When the user has been
+				authenticated, the access token for the user is
+				cached. The correct group memberships are then
+				returned from the cached user token (which can
+				be outdated).
+				</para>
+				</listitem>
+
+				<listitem>
+				<para>
+				User *NOT* authenticated: The information is
+				queries from the domain controller using the
+				machine account credentials which have limited
+				permissions. The result is normally incomplete
+				and can be also incorrect.
+				</para></listitem>
+			</orderedlist>
+		</listitem>
 		</varlistentry>
 
 		<varlistentry>