I apologize for all emails sent to resolve the acl problem. The instructions I followed to make an exact domain member erase; the problem is that the samba release used by debian 9 was buggy; I switched to devuan (which I start to love) and I went through the whole procedure: now everything is ok