[Samba] How do I add accounts when using ldap authentication?

[K. Richard Pixley]

I'm confused about how ldap authentication is expected to work.  Right
now I'm seeing linux authentication work, apparently, but no samba
users.

[root at violet samba]# pdbedit -Lv
[root at violet samba]# smbpasswd -a rpixley
New SMB password:
Retype new SMB password:
ldapsam_search_one_group: Problem during the LDAP search: LDAP error:  (No such object)ldapsam_modify_entry: Failed to add user dn= uid=rpixley,ou=People,dc=isw1,dc=symbol,dc=com with: Already exists

ldapsam_add_sam_account: failed to modify/add user with uid = rpixley (dn = uid=rpixley,ou=People,dc=isw1,dc=symbol,dc=com)
Failed to add entry for user rpixley.
Failed to modify password entry for user rpixley

Relevant smb.conf lines are:

# ldap
ldap admin dn = "cn=root,dc=isw1,dc=symbol,dc=com"
ldap ssl = off
passdb backend = ldapsam:ldap://ldap.isw1.symbol.com
ldap user suffix = ou=People,dc=isw1,dc=symbol,dc=com
ldap group suffix = ou=Groups,dc=isw1,dc=symbol,dc=com
ldap machine suffix = ou=Computers,dc=isw1,dc=symbol,dc=com
ldap suffix = dc=isw1,dc=symbol,dc=com
ldap filter = (&(uid=%u)(objectclass=sambaSamAccount))
ldap passwd sync = yes

Anyone see an obvious flaw in what I'm doing?  Or can anyone point me
toward clarifying doc?  (most of this comes from the howto).

Redhat Enterprise Linux, stock, up-to-date, apparently running
samba-3.0.2, openldap 2.0.27.

--rich