為了能夠以一個帳號通用所有服務，我們打算利用openldap來管理user的權限，在samba上我們打算以現在ldap上的group來做讀寫權限的控管，但經過多次測試，均無法成功，想請問是否有未設定的地方。
我使用的是
sernet-samba 4.2.12 + nslcd + openldap

smb.conf:
-------------------------------------------------------------
[global]
workgroup = WORKGROUP
netbios name = NAS01

deadtime = 10

log level = 1
log file = /var/log/samba/log.%m
max log size = 5000
debug pid = yes
debug uid = yes
syslog = 0
utmp = yes

security = user
domain logons = yes
local master = yes
domain master = yes
preferred master = yes
os level = 64
logon path =
logon home =
logon drive =
logon script =

passdb backend = ldapsam:"ldap://192.168.2.221/"
ldap ssl = no
ldap admin dn = "cn=manager,dc=office"
ldap delete dn = no

## Sync UNIX password with Samba password
## Method 1:
ldap password sync = yes
## Method 2:
;ldap password sync = no
;unix password sync = yes
;passwd program = /usr/sbin/smbldap-passwd -u '%u'
;passwd chat = "Changing *\nNew password*" %n\n "*Retype new password*" %n\n"

ldap suffix = "dc=office"
ldap user suffix = "ou=people"
ldap group suffix = "ou=smbgroup"

add user script = /usr/sbin/smbldap-useradd -m '%u' -t 1
rename user script = /usr/sbin/smbldap-usermod -r '%unew' '%uold'
delete user script = /usr/sbin/smbldap-userdel '%u'
set primary group script = /usr/sbin/smbldap-usermod -g '%g' '%u'
add group script = /usr/sbin/smbldap-groupadd -p '%g'
delete group script = /usr/sbin/smbldap-groupdel '%g'
add user to group script = /usr/sbin/smbldap-groupmod -m '%u' '%g'
delete user from group script = /usr/sbin/smbldap-groupmod -x '%u' '%g'
add machine script = /usr/sbin/smbldap-useradd -w '%u' -t 1

[AD共享區]
comment = RD共享區
path=/mnt/smb/01
browseable = yes
writable = yes
directory mode = 0755
write list = @AD
-------------------------------------------------------------

nslcd.conf
-------------------------------------------------------------
uid nslcd
gid ldap

uri ldap://192.168.2.221/

base dc=office

base group ou=smbgroup,dc=office
base passwd ou=people,dc=office
base shadow ou=people,dc=office

ssl no
tls_cacertdir /etc/openldap/cacerts
-------------------------------------------------------------

請各位幫我看看是不是有啥沒設到的，謝謝

結果我自己解了，問題在我是使用現有的LDAP SERVER， 所以在設定使用者時是另外加入 sambaSamAccount 這個 objectClass，在加入時所以使用者的 sambaSID 都設成相同的，結果導致SAMBA認定是同一個帳號而給予想同權限了