samba - Aug 2003 - Samba 3.0 PDC+LDAP

I've just moved our current Samba installation to LDAP (to try to combat
some other issues), and I've run into a large number of problems.  One of
them is that I'm quite new to LDAP.

I've made our entries to be:
    organizationalPerson
    inetOrgPerson
    posixAccount
    sambaSamAccount

I know that the 'Samba (v3) PDC LDAP howto' is out of date, and the
Samba
documentation (the HOWTO collection) says that Samba uses posixGroup to
handle group mappings.

However, this is what I see when I do a 'net group':

    [2003/08/09 16:30:01, 2] lib/interface.c:add_interfac79)
      added interface ip=192.168.42.11 bcast=192.168.42.255 nmask=255.255.255.0
    [2003/08/09 16:30:01, 2] libsmb/namequery.c:name_quer484)
      Got a positive name query response from 127.0.0.1 192.168.42.11 )
    Password:
    [2003/08/09 16:30:03, 2] libsmb/cliconnect.c:cli_session_setup_spneg633)
      Doing spnego session setupblob length=58)
    [2003/08/09 16:30:03, 2] utils/net.c:mai683)
      return code = 0

I can't see any groups, nor any group mappings.  Does anyone have any
up-to-date docs (even some notes) on setting up 3.0 to work with LDAP well?

I had tried the import tool, but it didn't actually /do/ anything -- I could
see the LDAP searches, but not the additions.

Damian Gerow wrote:
      return code = 0
> 
> I can't see any groups, nor any group mappings.  Does anyone have any
> up-to-date docs (even some notes) on setting up 3.0 to work with LDAP well?
> 
> I had tried the import tool, but it didn't actually /do/ anything -- I
could
> see the LDAP searches, but not the additions.
What did you do to set up groupmapping?

Thus spake paul k (paul@subsignal.org) [10/08/03 09:30]:
> Damian Gerow wrote:
>      return code = 0
> >
> >I can't see any groups, nor any group mappings.  Does anyone have
any
> >up-to-date docs (even some notes) on setting up 3.0 to work with LDAP
well?
> >
> >I had tried the import tool, but it didn't actually /do/ anything
-- I
> >could
> >see the LDAP searches, but not the additions.
> 
> What did you do to set up groupmapping?
Nothing yet.  I'm moving from the smbpasswd backend, and it 'just
worked' in
there.  That's why I was asking for some docs -- I'm sure this is
something
that I'm missing, but I just don't know what.

If I do /any/ sort of group mappings at all, I get this:

    [2003/08/10 21:45:44, 2] lib/interface.c:add_interfac79)
      added interface ip=192.168.42.11 bcast=192.168.42.255 nmask=255.255.255.0
    [2003/08/10 21:45:44, 2] lib/smbldap.c:smbldap_search_domain_inf1228)
      Searching for:objectClass=sambaDomainsambaDomainName=SENTEX))]
    [2003/08/10 21:45:44, 2] lib/smbldap.c:smbldap_search_suffi1056)
      smbldap_search_suffix: searching
for:objectClass=sambaDomainsambaDomainName=SENTEX))]
    [2003/08/10 21:45:44, 2] lib/smbldap.c:smbldap_open_connectio623)
      smbldap_open_connection: connection opened
    [2003/08/10 21:45:44, 2] passdb/pdb_ldap.c:ldapsam_search_one_grou1619)
      ldapsam_search_one_group: searching
for:objectClass=sambaGroupMappingdisplayName=Domain Adminscn=Domain Admins)))]
    NT Group Domain Admins doesn't exist in mapping DB
    [2003/08/10 21:45:44, 2] utils/net.c:mai683)
      return code = -1

So I'm not sure what it's looking for in LDAP -- something with a cn of
Domain\ Admins?  But where?  And why can't I add the group via 'net
group
add'?