diff --git a/API.txt b/API.txt
index e4ed91eb0..8e1f7713a 100644
--- a/API.txt
+++ b/API.txt
@@ -2329,13 +2329,13 @@ arg: Str('cn', attribute=True, cli_name='name', multivalue=False, pattern='^[-_
 option: Str('addattr*', cli_name='addattr', exclude='webui')
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
 option: Str('attrs', attribute=False, cli_name='attrs', multivalue=True, required=False)
-option: Str('extratargetfilter', attribute=False, cli_name='extratargetfilter', multivalue=True, required=False)
+option: Str('extratargetfilter', attribute=False, cli_name='filter', multivalue=True, required=False)
 option: Str('filter', attribute=False, cli_name='filter', multivalue=True, required=False)
 option: StrEnum('ipapermbindruletype', attribute=True, autofill=True, cli_name='bindtype', default=u'permission', multivalue=False, required=True, values=(u'permission', u'all', u'anonymous'))
 option: DNOrURL('ipapermlocation', alwaysask=True, attribute=True, autofill=False, cli_name='subtree', multivalue=False, query=False, required=False)
 option: StrEnum('ipapermright', attribute=True, cli_name='permissions', multivalue=True, required=False, values=(u'read', u'search', u'compare', u'write', u'add', u'delete', u'all'))
 option: DNParam('ipapermtarget', attribute=True, cli_name='target', multivalue=False, required=False)
-option: Str('ipapermtargetfilter', attribute=True, cli_name='filter', multivalue=True, required=False)
+option: Str('ipapermtargetfilter', attribute=True, cli_name='rawfilter', multivalue=True, required=False)
 option: Str('memberof', alwaysask=True, attribute=False, autofill=False, cli_name='memberof', multivalue=True, query=False, required=False)
 option: Flag('no_members', autofill=True, default=False, exclude='webui')
 option: Str('permissions', attribute=False, cli_name='permissions', multivalue=True, required=False)
@@ -2385,7 +2385,7 @@ arg: Str('criteria?', noextrawhitespace=False)
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
 option: Str('attrs', attribute=False, autofill=False, cli_name='attrs', multivalue=True, query=True, required=False)
 option: Str('cn', attribute=True, autofill=False, cli_name='name', multivalue=False, pattern='^[-_ a-zA-Z0-9.]+$', primary_key=True, query=True, required=False)
-option: Str('extratargetfilter', attribute=False, autofill=False, cli_name='extratargetfilter', multivalue=True, query=True, required=False)
+option: Str('extratargetfilter', attribute=False, autofill=False, cli_name='filter', multivalue=True, query=True, required=False)
 option: Str('filter', attribute=False, autofill=False, cli_name='filter', multivalue=True, query=True, required=False)
 option: StrEnum('ipapermbindruletype', attribute=True, autofill=False, cli_name='bindtype', default=u'permission', multivalue=False, query=True, required=False, values=(u'permission', u'all', u'anonymous'))
 option: Str('ipapermdefaultattr', attribute=True, autofill=False, cli_name='defaultattrs', multivalue=True, query=True, required=False)
@@ -2394,7 +2394,7 @@ option: Str('ipapermincludedattr', attribute=True, autofill=False, cli_name='inc
 option: DNOrURL('ipapermlocation', attribute=True, autofill=False, cli_name='subtree', multivalue=False, query=True, required=False)
 option: StrEnum('ipapermright', attribute=True, autofill=False, cli_name='permissions', multivalue=True, query=True, required=False, values=(u'read', u'search', u'compare', u'write', u'add', u'delete', u'all'))
 option: DNParam('ipapermtarget', attribute=True, autofill=False, cli_name='target', multivalue=False, query=True, required=False)
-option: Str('ipapermtargetfilter', attribute=True, autofill=False, cli_name='filter', multivalue=True, query=True, required=False)
+option: Str('ipapermtargetfilter', attribute=True, autofill=False, cli_name='rawfilter', multivalue=True, query=True, required=False)
 option: Str('memberof', attribute=False, autofill=False, cli_name='memberof', multivalue=True, query=True, required=False)
 option: Flag('no_members', autofill=True, default=False, exclude='webui')
 option: Str('permissions', attribute=False, autofill=False, cli_name='permissions', multivalue=True, query=True, required=False)
@@ -2417,7 +2417,7 @@ option: Str('addattr*', cli_name='addattr', exclude='webui')
 option: Flag('all', autofill=True, cli_name='all', default=False, exclude='webui')
 option: Str('attrs', attribute=False, autofill=False, cli_name='attrs', multivalue=True, required=False)
 option: Str('delattr*', cli_name='delattr', exclude='webui')
-option: Str('extratargetfilter', attribute=False, autofill=False, cli_name='extratargetfilter', multivalue=True, required=False)
+option: Str('extratargetfilter', attribute=False, autofill=False, cli_name='filter', multivalue=True, required=False)
 option: Str('filter', attribute=False, autofill=False, cli_name='filter', multivalue=True, required=False)
 option: StrEnum('ipapermbindruletype', attribute=True, autofill=False, cli_name='bindtype', default=u'permission', multivalue=False, required=False, values=(u'permission', u'all', u'anonymous'))
 option: Str('ipapermexcludedattr', attribute=True, autofill=False, cli_name='excludedattrs', multivalue=True, required=False)
@@ -2425,7 +2425,7 @@ option: Str('ipapermincludedattr', attribute=True, autofill=False, cli_name='inc
 option: DNOrURL('ipapermlocation', attribute=True, autofill=False, cli_name='subtree', multivalue=False, required=False)
 option: StrEnum('ipapermright', attribute=True, autofill=False, cli_name='permissions', multivalue=True, required=False, values=(u'read', u'search', u'compare', u'write', u'add', u'delete', u'all'))
 option: DNParam('ipapermtarget', attribute=True, autofill=False, cli_name='target', multivalue=False, required=False)
-option: Str('ipapermtargetfilter', attribute=True, autofill=False, cli_name='filter', multivalue=True, required=False)
+option: Str('ipapermtargetfilter', attribute=True, autofill=False, cli_name='rawfilter', multivalue=True, required=False)
 option: Str('memberof', attribute=False, autofill=False, cli_name='memberof', multivalue=True, required=False)
 option: Flag('no_members', autofill=True, default=False, exclude='webui')
 option: Str('permissions', attribute=False, autofill=False, cli_name='permissions', multivalue=True, required=False)
diff --git a/ipalib/plugins/permission.py b/ipalib/plugins/permission.py
index 7dde36d62..3319028f2 100644
--- a/ipalib/plugins/permission.py
+++ b/ipalib/plugins/permission.py
@@ -231,15 +231,17 @@ class permission(baseldap.LDAPObject):
         ),
         Str(
             'extratargetfilter*', prevalidate_filter,
+            cli_name='filter',
             label=_('Extra target filter'),
-            doc=_('Target filter, excluding filters set by type and memberof'),
+            doc=_('Extra target filter'),
             flags={'virtual_attribute'},
         ),
         Str(
             'ipapermtargetfilter*', prevalidate_filter,
-            cli_name='filter',
-            label=_('Target filter'),
-            doc=_('Target filter'),
+            cli_name='rawfilter',
+            label=_('Raw target filter'),
+            doc=_('All target filters, including those implied by '
+                  'type and memberof'),
         ),
 
         DNParam(
diff --git a/ipatests/test_xmlrpc/test_permission_plugin.py b/ipatests/test_xmlrpc/test_permission_plugin.py
index 3421ddce8..aaa98396d 100644
--- a/ipatests/test_xmlrpc/test_permission_plugin.py
+++ b/ipatests/test_xmlrpc/test_permission_plugin.py
@@ -1488,7 +1488,7 @@ class test_permission(Declarative):
             command=('permission_mod', [permission1],
                      {'ipapermtargetfilter': u"cn=admin"}),
             expected=errors.ValidationError(
-                name='filter',
+                name='rawfilter',
                 error='must be enclosed in parentheses'),
         ),