[Samba] Winbind with one-way trusts?

[Ian Masterson]

Winbind works very well for most of the domains with which we have trusts. 
But for one domain, 'groups DOMAIN\user' returns only gid 0, and I see 
kerberos errors in winbind logs:

[2008/01/31 13:51:12, 1] libsmb/clikrb5.c:ads_krb5_mk_req(602) ads_krb5_mk_req: krb5_get_credentials failed for foo$@THEIRDOMAIN (Server  not found in Kerberos database)
[2008/01/31 13:51:12, 1] nsswitch/winbindd_ads.c:ads_cached_connection(128)  ads_connect for domain THEIRDOMAIN failed: Server not found in Kerberos database
[2008/01/31 13:51:12, 1] nsswitch/winbindd_user.c:winbindd_dual_userinfo(152)  error getting user info for sid S-1-[...]

Don McCall appears to have had the same problem:

http://lists.samba.org/archive/samba-technical/2007-February/051678.html

Jerry confirmed that a two-way trust is required between the domain that 
the winbind host belongs to and any trusted domains. Is there any 
workaround to this at all?

Is it perhaps possible have winbind use credentials from the trusted 
domain to bind to the DC for looking up user information?

Thank you,

Ian Masterson
University of Washington Libraries