samba - Aug 2009 - Delay of group membership modifications

Hello,

We use samba 3.2.5 on Debian Lenny with LDAP backend (OpenLDAP 2.4.11).
Access to files and directories are granted via ACLs.

For example, we have a directory "projekt-my-test":

# getfacl projekt-my-test

# file: projekt-my-test/
# owner: root
# group: Domain\040Admins
user::rwx
group::rwx
group:projekt-my-test-rw:rwx
mask::rwx
other::---

So, I added a user to the group "projekt-my-test-rw" in the LDAP tree.
I could confirm with "getent group" that the user was now member of
the group.

But when the user tried to access the directory, access was denied.

When I checked with "net RPC GROUP MEMBERS projekt-my-test-rw", the
user was not
listed as a group member.

After I waited for about half an hour, the user suddenly could access the 
directory. And really, when I checked now with the net RPC GROUP MEMBERS,
the user was listed as a member.

I did some research if samba does some caching regarding user and group
information
from a LDAP server, but hadn't found anything.

So I wanted to ask the experts on the list: What is causing this delay of about 
30 minutes of group membership modification in the LDAP database and the
recognition by
Samba? And how can I prevent it, i. e. how can I force samba, to re-read/refresh
group
information from LDAP (besides from a restart of the service)?

Regards,

Henry

>But when the user tried to access the directory, access was denied.
>When I checked with "net RPC GROUP MEMBERS projekt-my-test-rw",
the user was not
>listed as a group member.
>After I waited for about half an hour, the user suddenly could access the 
Is the host running nscd?  If so, stop the nscd service.