[Samba] Samba+ADS+groups>32 = broken Samba

[Andrew Stewart]

I've got a strange problem with certain Active Directory user accounts that
are members of more than 32 groups.  It seems that Samba (or winbind?)
completely ignores extended groups if it crosses over 32 groups.

This seems to be a Samba specific issue;

* When the AD user is logs in via ssh, it can perform writes to the
resource; the same user browsing via Samba will get an "Access Denied"
error.

* Additionally, same user, same groups, same resource, writes will occur if
it uses vsftpd, writes won't if its through Samba.

* If the primary group is changed to the group of the resource, the user can
write via Samba; however if the primary group is something else yet the user
is a member of the resource group in extended groups, "Access Denied" again.


Everything works perfectly.  Wibind is returning all the proper users and
groups of AD.

This is debian-sarge.  Samba 3.0.14a-3sarge4.  Kernel 2.6.20.  Windows
Server 2000 SP4 - Active Directory.

Any help is greatly appreciated.

smb.conf:

[global]
	dos charset = CP850
	unix charset = UTF-8
	display charset = LOCALE
	workgroup = XYZ
	realm = XYZ.LOCAL
	netbios name = A-WHITEWATER
	netbios aliases =
	netbios scope =
	server string = ""
	interfaces =
	bind interfaces only = No
	security = ADS
	auth methods = winbind
	encrypt passwords = Yes
	update encrypted = No
	client schannel = Auto
	server schannel = Auto
	allow trusted domains = No
	hosts equiv =
	min password length = 5
	map to guest = Never
	null passwords = No
	obey pam restrictions = Yes
	password server = xxx.xxx.xxx.yyy
	smb passwd file = /etc/samba/smbpasswd
	private dir = /etc/samba
	passdb backend = smbpasswd
	algorithmic rid base = 1000
	root directory =
	guest account = nobody
	enable privileges = No
	pam password change = No
	passwd program =
	passwd chat = *new*password* %n\n *new*password* %n\n *changed*
	passwd chat debug = No
	passwd chat timeout = 2
	check password script =
	username map =
	password level = 0
	username level = 0
	unix password sync = No
	restrict anonymous = 0
	lanman auth = Yes
	ntlm auth = Yes
	client NTLMv2 auth = No
	client lanman auth = Yes
	client plaintext auth = Yes
	preload modules =
	use kerberos keytab = No
	log level = 3
	syslog = 1
	syslog only = No
	log file = /var/log/samba/%m
	max log size = 0
	debug timestamp = Yes
	debug hires timestamp = No
	debug pid = No
	debug uid = No
	smb ports = 445 139
	large readwrite = Yes
	max protocol = NT1
	min protocol = CORE
	read bmpx = No
	read raw = Yes
	write raw = Yes
	disable netbios = No
	acl compatibility =
	defer sharing violations = Yes
	nt pipe support = Yes
	nt status support = Yes
	announce version = 4.9
	announce as = NT
	max mux = 50
	max xmit = 16644
	name resolve order = host bcast
	max ttl = 259200
	max wins ttl = 518400
	min wins ttl = 21600
	time server = No
	unix extensions = Yes
	use spnego = Yes
	client signing = auto
	server signing = No
	client use spnego = Yes
	change notify timeout = 60
	deadtime = 0
	getwd cache = Yes
	keepalive = 300
	kernel change notify = Yes
	lpq cache time = 30
	max smbd processes = 0
	paranoid server security = Yes
	max disk size = 0
	max open files = 10000
	socket options = TCP_NODELAY
	use mmap = Yes
	hostname lookups = Yes
	name cache timeout = 660
	load printers = No
	printcap cache time = 0
	printcap name =
	cups server =
	disable spoolss = No
	enumports command =
	addprinter command =
	deleteprinter command =
	show add printer wizard = Yes
	os2 driver map =
	mangling method = hash2
	mangle prefix = 1
	stat cache = Yes
	machine password timeout = 604800
	add user script =
	delete user script =
	add group script =
	delete group script =
	add user to group script =
	delete user from group script =
	set primary group script =
	add machine script =
	shutdown script =
	abort shutdown script =
	logon script =
	logon path = \\%N\%U\profile
	logon drive =
	logon home = \\%N\%U
	domain logons = No
	os level = 20
	lm announce = Auto
	lm interval = 60
	preferred master = No
	local master = No
	domain master = No
	browse list = Yes
	enhanced browsing = Yes
	dns proxy = Yes
	wins proxy = No
	wins server =
	wins support = No
	wins hook =
	wins partners =
	kernel oplocks = Yes
	lock spin count = 3
	lock spin time = 10
	oplock break wait time = 0
	ldap admin dn =
	ldap delete dn = No
	ldap filter = (uid=%u)
	ldap group suffix =
	ldap idmap suffix =
	ldap machine suffix =
	ldap passwd sync = no
	ldap replication sleep = 1000
	ldap suffix =
	ldap ssl =
	ldap timeout = 15
	ldap user suffix =
	add share command =
	change share command =
	delete share command =
	config file =
	preload =
	lock directory =
	pid directory = /var/run/samba
	utmp directory =
	wtmp directory =
	utmp = No
	default service =
	message command =
	dfree command =
	get quota command =
	set quota command =
	remote announce =
	remote browse sync =
	socket address = 0.0.0.0
	homedir map = auto.home
	afs username map =
	afs token lifetime = 604800
	log nt token command =
	time offset = 0
	NIS homedir = No
	panic action = /usr/share/samba/panic-action %d
	host msdfs = No
	enable rid algorithm = Yes
	idmap backend =
	idmap uid = 45000-50000
	idmap gid = 45000-50000
	template primary group = nobody
	template homedir = /var/ftp/%u
	template shell = /bin/sh
	winbind separator = \
	winbind cache time = 300
	winbind enable local accounts = No
	winbind enum users = Yes
	winbind enum groups = Yes
	winbind use default domain = Yes
	winbind trusted domains only = No
	winbind nested groups = Yes
	comment =
	path = 2775
	username =
	invalid users =
	valid users =
	admin users =
	read list =
	write list =
	printer admin =
	force user =
	force group =
	read only = Yes
	create mask = 0664
	force create mode = 0664
	security mask = 0777
	force security mode = 00
	directory mask = 0755
	force directory mode = 02775
	directory security mask = 0777
	force directory security mode = 00
	force unknown acl user = No
	inherit permissions = No
	inherit acls = No
	guest only = No
	guest ok = No
	only user = No
	hosts allow =
	hosts deny =
	allocation roundup size = 1048576
	ea support = No
	nt acl support = Yes
	profile acls = No
	map acl inherit = No
	afs share = No
	block size = 1024
	max connections = 0
	min print space = 0
	strict allocate = No
	strict sync = No
	sync always = No
	use sendfile = No
	write cache size = 0
	max reported print jobs = 0
	max print jobs = 1000
	printable = No
	printing = bsd
	cups options =
	print command = lpr -r -P'%p' %s
	lpq command = lpq -P'%p'
	lprm command = lprm -P'%p' %j
	lppause command =
	lpresume command =
	queuepause command =
	queueresume command =
	printer name =
	use client driver = No
	default devmode = No
	force printername = No
	default case = lower
	case sensitive = Auto
	preserve case = Yes
	short preserve case = Yes
	mangling char = ~
	hide dot files = Yes
	hide special files = No
	hide unreadable = No
	hide unwriteable files = No
	delete veto files = No
	veto files =
	hide files =
	veto oplock files =
	map system = No
	map hidden = No
	map archive = Yes
	mangled names = Yes
	mangled map =
	store dos attributes = No
	browseable = Yes
	blocking locks = Yes
	csc policy = manual
	fake oplocks = No
	locking = Yes
	oplocks = Yes
	level2 oplocks = Yes
	oplock contention limit = 2
	posix locking = Yes
	strict locking = Yes
	share modes = Yes
	copy =
	include = /etc/samba/shares.conf
	preexec =
	preexec close = No
	postexec =
	root preexec =
	root preexec close = No
	root postexec =
	available = Yes
	volume =
	fstype = NTFS
	set directory = No
	wide links = Yes
	follow symlinks = Yes
	dont descend =
	magic script =
	magic output =
	delete readonly = No
	dos filemode = No
	dos filetimes = Yes
	dos filetime resolution = No
	fake directory create times = No
	vfs objects =
	msdfs root = No
	msdfs proxy =