The winbind service lookups secret entries in secrets.ldb using a filter similar to "(&(objectClass=blabla)(flatname=myfastmachine))". The problem is that although "flatname" is present in the DN, it is not set in the actual record. Setting it solves the issue.