
	# LDAP backend
	# ----------------------------------------------------------------------

	passdb backend = ldapsam:ldap://::ldap.server::
	ldap ssl = off
	ldap admin dn = ::ldap.admin::
	ldap suffix = ::ldap.base::
	ldap group suffix = ou=::ldap.slot_groups::
	ldap user suffix = ou=::ldap.slot_users::
	ldap machine suffix = ou=::ldap.slot_computers::
	ldap idmap suffix = ou=::ldap.slot_idmaps::
	ldap passwd sync = yes
	ldap delete dn = yes

	passwd program = /usr/sbin/smbldap-passwd %u
	passwd chat = *New*password* %n\n *Retype*new*password* %n\n *all*authentication*tokens*updated*

	# scripts for users/groups management via ldap
	# uses idelix wrappers (smbldap-tools)
	#
	# - fix: wrong idealix docs, missing -a results in useless non-samba accounts
	# - fix: -a ignored with -w (machine) flag, so we need a wrapper to launch
	#	useradd -w then usermod -a
	# - mod: uses wrapper to log actions to syslog

	# users scripts
	#
	add user script = sudo /usr/sbin/ku-smbldap-sudo smbldap-useradd -a -m "%u"
	delete user script = sudo /usr/sbin/ku-smbldap-sudo smbldap-userdel "%u"

	# groups scripts
	#
	add group script = sudo /usr/sbin/ku-smbldap-sudo smbldap-groupadd -a -p "%g"
	delete group script = sudo /usr/sbin/ku-smbldap-sudo smbldap-groupdel "%g"
	add user to group script = sudo /usr/sbin/ku-smbldap-sudo smbldap-groupmod -m "%u" "%g"
	delete user from group script = sudo /usr/sbin/ku-smbldap-sudo smbldap-groupmod -x "%u" "%g"
	set primary group script = sudo /usr/sbin/ku-smbldap-sudo smbldap-usermod -g "%g" "%u"

	# machines scripts
	#
	add machine script = sudo /usr/sbin/ku-smbldap-sudo ku-smbldap-computeradd "%u"

	# LDAP backend (end)

