net ads status shows lots of info that looks right.

excerpts from strace -o log getent passwd:

"
open("/lib/libnss_winbind.so.2", O_RDONLY) = 4
read(4, "\177ELF\1\1\1\0\0\0\0\0\0\0\0\0\3\0\3\0\1\0\0\0@\22\0\000"..., 512) = 512
fstat64(4, {st_mode=S_IFREG|0755, st_size=21084, ...}) = 0
old_mmap(NULL, 27804, PROT_READ|PROT_EXEC, MAP_PRIVATE, 4, 0) = 0x4016d000
madvise(0x4016d000, 27804, MADV_SEQUENTIAL|0x1) = 0
old_mmap(0x40171000, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED, 4,
0x3000) = 0x40171000
old_mmap(0x40172000, 7324, PROT_READ|PROT_WRITE,
MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x40172000
close(4)                                = 0
munmap(0x40165000, 30848)               = 0
getpid()                                = 3185
lstat64("/tmp/.winbindd", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0
lstat64("/tmp/.winbindd/pipe", {st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0
socket(PF_UNIX, SOCK_STREAM, 0)         = 4
fcntl64(4, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(4, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
fcntl64(4, F_GETFD)                     = 0
fcntl64(4, F_SETFD, FD_CLOEXEC)         = 0
connect(4, {sa_family=AF_UNIX, path="/tmp/.winbindd/pipe"}, 110) = 0
select(5, [4], NULL, NULL, {0, 0})      = 0 (Timeout)
write(4, "$\7\0\0\0\0\0\0q\f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828
select(5, [4], NULL, NULL, {5, 0})      = 1 (in [4], left {5, 0})
read(4, "\24\5\0\0\2\0\0\0\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300
select(5, [4], NULL, NULL, {0, 0})      = 0 (Timeout)
write(4, "$\7\0\0%\0\0\0q\f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1828) = 1828
select(5, [4], NULL, NULL, {5, 0})      = 1 (in [4], left {5, 0})
read(4, "D\5\0\0\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 1300) = 1300
select(5, [4], NULL, NULL, {5, 0})      = 1 (in [4], left {5, 0})
read(4, "/usr/local/samba//var/locks/winb"..., 48) = 48
lstat64("/usr/local/samba//var/locks/winbindd_privileged",
{st_mode=S_IFDIR|0750, st_size=4096, ...}) = 0
lstat64("/usr/local/samba//var/locks/winbindd_privileged/pipe",
{st_mode=S_IFSOCK|0777, st_size=0, ...}) = 0
socket(PF_UNIX, SOCK_STREAM, 0)         = 5
fcntl64(5, F_GETFL)                     = 0x2 (flags O_RDWR)
fcntl64(5, F_SETFL, O_RDWR|O_NONBLOCK)  = 0
fcntl64(5, F_GETFD)                     = 0
fcntl64(5, F_SETFD, FD_CLOEXEC)         = 0
connect(5, {sa_family=AF_UNIX,
path="/usr/local/samba//var/locks/winbindd_privileged/pipe"}, 110) = 0
close(4)          

Sorry seem to have forgotten this extra info:
cat /usr/local/samba/lib/smb.conf
[global]
# separate domain and username with '\', like DOMAIN\username
winbind separator = +
# use uids from 10000 to 20000 for domain users
 idmap uid = 10000-20000
# use gids from 10000 to 20000 for domain groups
 idmap gid = 10000-20000
# allow enumeration of winbind users and groups
winbind enum users = yes
winbind enum groups = yes
# give winbind users a real shell (only needed if they have telnet access)
template homedir = /home/%U
template shell = /bin/bash
winbind cache time = 600
winbind trusted domains only = yes

workgroup = BSS

# to remove domain from username
# winbind use default domain = yes
obey pam restrictions = Yes

realm = bss.phy.private.cam.ac.uk
security = ADS
encrypt passwords = yes
password server = sd1.bss.phy.private.cam.ac.uk

# Example share definition

[public]
comment = Public data directory
read only = no
path = /sambapublic
user = @"BSS.PHY.PRIVATE.CAM.AC.UK+domain users"


#grep winbind /etc/nsswitch.conf
passwd:     compat winbind
group:      compat winbind

# ps -ef | grep -E 'winbind|nmbd'
root      3169     1  0 Jul29 ?        00:00:02 nmbd
root      3171     1  0 Jul29 ?        00:00:01 winbindd -d 5
root      3172  3171  0 Jul29 ?        00:00:00 winbindd -d 5
root      3173  3171  0 Jul29 ?        00:00:01 winbindd -d 5

Are you sure this should be set for your environment?
"winbind trusted domains only = yes"?  Are there any trusted 
domains available?  (i.e. what is the output from wbinfo -u?)

*** Bug 2925 has been marked as a duplicate of this bug. ***

Argh.
I think I was using:
winbind trusted domains only = yes
to get rid of the prepended domain name from the getent passwd and group bits.
getent passwd now works.

wbinfo -m
BSS

That was from a previous setup using Samba 3 for single login for Windows and
linux (+ one place for directory info), which does work.

I tell myself RTM, and find:
winbind use default domain = yes
That seems to work.

I guess you can now close the bugs. Interesting that this worked for 3.0.9, half
worked for 3.0.14 (I think I got group not passwd using getent).

Thanks for looking at the problem.

If I could work out how to test getting the SFU properties from the Windows ADS
I would happily try it.

Found this:
"
Just as a heads up, Samba 3.0.20 will have support to
utilize the SFU schema for winbindd if you want to.
It's a new idmap plugin (idmap backend = ad).  And you will
be able to pull the home directory and shell information
as well (winbind nss support = sfu).
"
and entries in the WHATSNEW
Tried putting both settings in, but no luck:

w1:~# cat /usr/local/samba/lib/smb.conf 
[global]
# separate domain and username with '\', like DOMAIN\username
winbind separator = +
# use uids from 10000 to 20000 for domain users
# idmap uid = 10000-20000
# use gids from 10000 to 20000 for domain groups
# idmap gid = 10000-20000
# allow enumeration of winbind users and groups
winbind enum users = yes
winbind enum groups = yes
# give winbind users a real shell (only needed if they have telnet access)
template homedir = /home/%U
template shell = /bin/bash
winbind cache time = 600
# winbind trusted domains only = yes
winbind use default domain = yes

idmap backend = ad
winbind nss support = sfu

workgroup = BSS

# to remove domain from username
# winbind use default domain = yes
obey pam restrictions = Yes

realm = bss.phy.private.cam.ac.uk
security = ADS
encrypt passwords = yes
password server = sd1.bss.phy.private.cam.ac.uk



I was expecting to have to use NIS to distribute the user and group info, but it
looks like the SFU integration is going to be great.

Logs show things like this when I try getent passwd hoping to get uid and gid
from ADS:

[2005/08/02 08:58:55, 1] nsswitch/winbindd_user.c:winbindd_getpwent(712)
  could not lookup domain user mr

For my sanity I checked that I do have gid and uid settings in AD for this user
(mr) which are 500 and 100. I've also tried a few other settings in smb.conf
like including the idmap uid and gid ranges (100 - 10000), but no luck.
I assume I am missing something obvious.

Mike,

if idmap backend = ad is not working, let's open a new bug for that. 
Same thing for any new problems with winbind nss support = sfu.

Maybe your problem has to do with misspelling

"winbind nss support = sfu"

It is actually "winbind nss info = sfu".

Please reopen a new bug, as jerry said, if you are seeing problems with either
the SFU-support or the idmap_ad-module.

sorry for the same, cleaning up the database to prevent unecessary reopens of bugs.