[Samba] ldap users would like to change their own (smb)passwords

[jan]

Dear Samba list,


I am using samba with ldap. All works fine.
Now I want my users to change their own smbpasswd's.

That only works when :

domain admin groups = myusers
and
secrets.tdb is set to 660

beside this smb.conf must at least be readable by the myusers_group.

Otherwise I get this :

/usr/local/samba-2.2.7/bin/smbpasswd -L -a bert

Failed to open /usr/local/samba-2.2.7/private/secrets.tdb
New SMB password:
Retype new SMB password:
LDAPS option set...!

fetch_ldap_pw: ldap secret is too long (1073817312 > 1023)!
ldap_connect_system: Failed to retrieve password for cn=master, ... from 
secrets.tdb

Is there no more secure and better way to let users change their own 
(smb)passwd in the ldap directory
(also to avoid that user x change user's y passwd) ??


regards,



Jan