samba - Dec 2006 - can't add user to samba

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

while trying to add a user to samba
i.e smbpasswd -a user
i get the following error

init_ldap_from_sam: User's Primary Group SID (S-1-22-2-2009) is not for
this domain (S-1-5-21-2472404719-3990724825-3229645963), cannot add to LDAP!
ldapsam_add_sam_account: init_ldap_from_sam failed!
Failed to add entry for user foma.
Failed to modify password entry for user foma

tried adding the sid
via

net groupmap add  rid=513|sid="S-1-22-2-2009"
unixgroup="foma"
ntgroup="S-1-5-21-2472404719-3990724825-3229645963"

(this does not return an error . it does fail if rid=513 is ommited)

when i add -d4
in debug out put i find this
[2006/12/08 11:17:07, 4] passdb/pdb_ldap.c:ldapsam_getgroup(2213)
  ldapsam_getgroup: Did not find group
adding entry for group foma failed

basicly i am stumped at this point


ps: this is with samba 3.0.23b (under freebsd 6.1)
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iQCVAwUBRXmQvNbpM15f9s9nAQJVnQP/Yape9pdAMo89ZIHwOVx3FDRBAhozptlr
tDXzRvDF/XKlctR6IIKXx8QgtocP6Z2EgOlEFMK6/xUYelJKbEiC/3T1ChHbCzn2
iysF/kdsac8FEpVI2uuu3alJsGqYdMTAi8ccO7EYWJRoBgGWaVoN151x0PCTt+UJ
3HByIcN00Dg=vk5e
-----END PGP SIGNATURE-----

stas khromoy schrieb:
> init_ldap_from_sam: User's Primary Group SID (S-1-22-2-2009) is not for
> this domain (S-1-5-21-2472404719-3990724825-3229645963), cannot add to
LDAP!
Not surprising to me amateur, this SID looks way too short to me. What's
the output of "net getlocalsid" and "net groupmap list"?

My output:
kiste:/# net get localsid
SID for domain KISTE is: S-1-5-21-4175331462-3411459466-2109793049

kiste:/# net groupmap list
Domain Admins (S-1-5-21-4175331462-3411459466-2109793049-512) -> domain
Domain Users (S-1-5-21-4175331462-3411459466-2109793049-513) -> users
Domain Guests (S-1-5-21-4175331462-3411459466-2109793049-514) -> guests
Domain Computers (S-1-5-21-4175331462-3411459466-2109793049-515) -> Machines
Administrators (S-1-5-32-544) -> Administrators
Account Operators (S-1-5-32-548) -> Account Operators
Print Operators (S-1-5-32-550) -> Print Operators
Backup Operators (S-1-5-32-551) -> Backup Operators
Replicators (S-1-5-32-552) -> Replicators


	timbo