[Samba] wbinfo -a fails plaintext auth; passes challenge/response - HALF SOLVED ?

[Mike Leone]

A bit brute force, but I semi-solved it.

I left the domain. I deleted all files in /var/lib/samba. I rejoined domain.

net ads testjoin - works
getent passwd - works
wbinfo -u - works
wbinfo -g - works
wbinfo -t - works
wbinfo -a DACRIB+turgon .. half works.

$ wbinfo -a DACRIB+turgon
Enter DACRIB+turgon's password:
plaintext password authentication succeeded
Enter DACRIB+turgon's password:
challenge/response password authentication failed
error code was NT_STATUS_ACCESS_DENIED (0xc0000022)
error messsage was: winbind client not authorized to use
winbindd_pam_auth_crap. Ensure permissions on
/var/run/samba/winbindd_privileged are set correctly.
Could not authenticate user DACRIB+turgon with challenge/response

Running it as a sudo - works.

$ sudo wbinfo -a DACRIB+turgon
Enter DACRIB+turgon's password:
plaintext password authentication succeeded
Enter DACRIB+turgon's password:
challenge/response password authentication succeeded

Is that the way "wbinfo -a" works? It can only be run as root? It seems
so ...

HOWEVER ...

still can't mount a share ...

$ sudo mount -t smbfs -o username=DACRIB+turgon,password=Bub0n\!c
//workhorse/OldHome /mnt
mount error(13): Permission denied
Refer to the mount.cifs(8) manual page (e.g. man mount.cifs)

So I suppose I am making progress of sorts ... Still need to figure out
why I can't mount shares. Any pointers? Where to investigate? I have log
levels at 3, but don't see any errors in there.