[Samba] Testing domain group membership

[Rex Dieter]

Is there a samba command (using net,wbinfo, or whatever) to allow one to 
test whether a user is a member of a particular (domain) group?

I know that
$ net user info
returns the groups that a user is a (direct) member of, but for my 
immediate purposes, that is not sufficient (we're using nested groups).

I also know that
ntlm_auth has the --require-membership-of=STRING option, but it also 
requires one to have access to the users' password (to be tested) as well.

-- Rex