Document passdb:expand_explicit

diff --git a/docs/smbdotconf/security/passdbexpandexplicit.xml b/docs/smbdotconf/security/passdbexpandexplicit.xml
new file mode 100644 (file)
index 0000000..d76d55e
--- /dev/null
+++ b/docs/smbdotconf/security/passdbexpandexplicit.xml
@@ -0,0 +1,20 @@
+<samba:parameter name="passdb:expand_explicit"
+                 context="G"
+                 advanced="1" developer="0"
+                                type="boolean"
+                xmlns:samba="http://www.samba.org/samba/DTD/samba-doc">
+<description>
+    <para>
+    This parameter controls whether Samba substitutes %-macros in the passdb
+    fields if they are explicitly set. We used to expand macros here, but this
+    turned out to be a bug because the Windows client can expand a variable
+    %G_osver% in which %G would have been substituted by the user's primary
+    group.
+    </para>
+    <para>
+    If you rely on this behaviour, you have to set it explicitly to 'yes'
+    </para>
+</description>
+
+<value type="default">no</value>
+</samba:parameter>