docs: Add a not that 'wbinfo --user-groups' may be incomplete

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Wed Feb 14 20:32:18 CET 2018 on sn-devel-144

diff --git a/docs-xml/manpages/wbinfo.1.xml b/docs-xml/manpages/wbinfo.1.xml
index c427007be0fd89acfd2a64e578563f9efc0dc2e9..e2042ca623a017cd067788eb59c015cbfb97c120 100644 (file)
--- a/docs-xml/manpages/wbinfo.1.xml
+++ b/docs-xml/manpages/wbinfo.1.xml
@@ -384,10 +384,35 @@
 
                <varlistentry>
                <term>-r|--user-groups <replaceable>username</replaceable></term>
-               <listitem><para>Try to obtain the list of UNIX group ids
-               to which the user belongs.  This only works for users
-               defined on a Domain Controller.
-               </para></listitem>
+               <listitem>
+                       <para>
+                       Try to obtain the list of UNIX group ids to which the
+                       user belongs.  This only works for users defined on a
+                       Domain Controller.
+                       </para>
+
+                       <para>There are two scenaries:</para>
+                       <orderedlist>
+                               <listitem>
+                               <para>
+                               User authenticated: When the user has been
+                               authenticated, the access token for the user is
+                               cached. The correct group memberships are then
+                               returned from the cached user token (which can
+                               be outdated).
+                               </para>
+                               </listitem>
+
+                               <listitem>
+                               <para>
+                               User *NOT* authenticated: The information is
+                               queries from the domain controller using the
+                               machine account credentials which have limited
+                               permissions. The result is normally incomplete
+                               and can be also incorrect.
+                               </para></listitem>
+                       </orderedlist>
+               </listitem>
                </varlistentry>
 
                <varlistentry>