[Samba] 4.1.11 PAM winbind problem on ubuntu 14.04

[steve]

Lubuntu 14.04
samba 4.1.11, DC and 2 node cluster
ctdb 2.5.3

Hi
Problem:
Non domain users are prompted twice for their passwords:

stack at /etc/pam.d:
auth sufficient pam_winbind.so
auth [success=2 default=ignore] pam_unix.so nullok_secure
auth requisite   pam_deny.so
auth required   pam_permit.so
auth optional   pam_cap.so 
account sufficient      pam_winbind.so
account [success=1 new_authtok_reqd=done default=ignore] pam_unix.so 
account requisite   pam_deny.so
account required   pam_permit.so
account sufficient   pam_localuser.so 

We have:
ln -s /usr/local/samba/lib/libnss_winbind.so.2 /lib/libnss_winbind.so
ln -s /lib/libnss_winbind.so /lib/libnss_winbind.so.2
sudo cp /usr/local/samba/lib/security/pam_winbind.so /lib/security

The setup has worked OK 'till 4.1.11 although the pam winbind line was a
guess which leads us to think this is a problem with the latest
pam_winbind library.

Could someone send us their working ubuntu or debian pam winbind or
otherwise correct us?
Cheers,
Steve