[Samba] CTDB no secrets.tdb created

[steve]

Hi
2 node ctdb 2.5.3 on Ubuntu 14.04 nodes

apparmor teardown and firewall and stopped dead

The IP takeover is working fine between the nodes:
Jul 21 14:12:03 uc1 ctdbd: recoverd:Trigger takeoverrun
Jul 21 14:12:03 uc1 ctdbd: recoverd:Takeover run starting
Jul 21 14:12:04 uc1 ctdbd: Takeover of IP 192.168.1.81/24 on interface
bond0
Jul 21 14:12:04 uc1 ctdbd: Takeover of IP 192.168.1.80/24 on interface
bond0
Jul 21 14:12:05 uc1 ctdbd: Monitoring event was cancelled
Jul 21 14:12:05 uc1 ctdbd: recoverd:Takeover run completed successfully
Jul 21 14:12:06 uc1 ntpd[3759]: Listen normally on 10 bond0 192.168.1.81
UDP 123
Jul 21 14:12:06 uc1 ntpd[3759]: Listen normally on 11 bond0 192.168.1.80
UDP 123
Jul 21 14:12:06 uc1 ntpd[3759]: peers refreshed
Jul 21 14:12:06 uc1 ntpd[3759]: new interface(s) found: waking up
resolver
Jul 21 14:12:08 uc1 ctdbd: monitor event OK - node re-enabled
Jul 21 14:12:08 uc1 ctdbd: Node became HEALTHY. Ask recovery master 0 to
perform ip reallocation
Jul 21 14:12:08 uc1 ctdbd: recoverd:Node 0 has changed flags - now 0x0
was 0x2
Jul 21 14:12:08 uc1 ctdbd: recoverd:Takeover run starting
Jul 21 14:12:09 uc1 ctdbd: recoverd:Takeover run completed successfully

but on joining node 1 to the domain, no secrets.tdb is created:

sudo net ads join -UAdministrator
Enter Administrator's password:
Using short domain name -- ALTEA
Joined 'SMBCLUSTER' to dns domain 'altea.site'
Not doing automatic DNS update in a clustered setup.
 
The persistent folder contains only:
/usr/local/var/lib/ctdb/persistent
-rw------- 1 root root 1310720 jul 21 14:11 ctdb.tdb.0
(with ctdb.tdb.1 of the same size on node 2)

/etc/samba/smb.conf
[global]
workgroup = ALTEA
realm = ALTEA.SITE
security = ADS
kerberos method = secrets only
netbios name = SMBCLUSTER
winbind enum users = Yes
winbind enum groups = Yes
winbind use default domain = Yes
winbind nss info = rfc2307
idmap config * : backend = tdb
idmap config * : range = 19900-19999
idmap config ALTEA : backend  = ad
idmap config ALTEA : range = 20000-4000000
idmap config ALTeA : schema_mode = rfc2307
clustering = Yes
ctdbd socket = /usr/local/var/run/ctdb/ctdbd.socket
[users]
path = /cluster/users
read only = No
[profiles]
path = /cluster/profiles
read only = No

We've tried with the stock ubuntu ctdb 2.5.1, the upstream 2.5.3 and now
with 2.5.3 that we've built.

The socket appears fine in the specified location.
Why do we get no secrets.tdb created?

Cheers,
Steve