samba - Aug 2004 - Inter. between Samba 2.2.x and 3.x w/ LDAP backend (and another changes)

Hi all,

I have a network that are composed at this way:

- Samba 2.2.8a PDC
- Samba 2.2.8a BDC
- Some Samba 2.2.8a as MS
- OpenLDAP 2.1 as backend (w/ Samba2 schema)

We are planning some changes, including change the domain name. For this, we
planning to setup the new Samba 3 domain on the same environment as the Samba 2,
and sharing the same backend using the ldapsam_compat feature. After the
workstations are changed to the new domain, we will convert the LDAP to the
Samba 3 schema.

In tests, we found some problems:

- In Samba 3, we have the "built-in" accounts, which must be mapped to
unix accounts. When I try to map it using the "idmap ldap backend", we
receive an error;
- Using the tdbbackend, we can map the "Domain Admins" group, but when
I try to add a machine on domain, we receive "the user or password is
incorrect" (the machine account is created). Testing with "net
join", using an user of "Domain Admins" group (after the map), I
receive "this user could not have administrative rights". Reading the
Idealx howto, I found that, in LDAP, is created a "Domain Admins" with
an user "Administrator" with UID 0.

Questions:

- Is it possible to use the idmap ldap backend with ldapsam_compat? Someone has
an example?
- In Samba 3, we don't have some option as "domain admin group" (I
read that this parameter isn't used)? I  believed that mapping the Unix
Group to "Domains Admins" can be done it. We need to have an user with
UID 0?
- I see on LDAP Account Manager (lam.sourceforge.net), on live demo that
the Domain SID are stored on LDAP backend, and not on secrets.tdb, is it
correct? If yes, how to make it? Is possible to store more than one SID?
- In some examples, all groups uses the posixGroup and sambaGroup objectclass,
this can be the error in my built-in account maps? In Samba 3, is it mandatory?
If I do it with all my groups, I can view then on Windows Workstations? (without
the sambaGroup, on Samba 2, I can use it to provide access control on
filesystem, but it can't be listed on Windows machines)

Sirs, I need to make this change. I can't found any doc in the net about
this setup. I believe that I can write my experience about after , and I need
this help to make it. Please, any help will be apreciated.

With best regards,

Fabiano Felix