krb5.conf

[libdefaults]
        default_realm = DOMAIN.LOCAL
        default_etypes = rc4-hmac des-cbc-crc des-cbc-md5
        default_etypes_des = rc4-hmac des-cbc-crc des-cbc-md5
        fcc-mit-ticketflags = true
        default_tgs_enctypes = rc4-hmac des-cbc-md5 des-cbc-crc
        default_tkt_enctypes = rc4-hmac des-cbc-md5 des-cbc-crc
        preferred_enctypes = rc4-hmac des-cbc-md5 des-cbc-crc
        dns_lookup_kdc = true
        permitted_enctypes = rc4-hmac des-cbc-md5 des-cbc-crc
        dns_lookup_realm = true
        krb4_config = /etc/krb.conf
        krb4_realms = /etc/krb.realms
        kdc_timesync = 1
        ccache_type = 4
        forwardable = true
        proxiable = true
        default_keytab_name = FILE:/etc/krb5.keytab
        v4_instance_resolve = false
        v4_name_convert = {
                host = {
                        rcmd = host
                        ftp = ftp
                }
                plain = {
                        something = something-else
                }
        }
        fcc-mit-ticketflags = true

[realms]
        TDTOBOL.LOCAL = {
                kdc = dc1.domain.local
                admin_server = dc1.domain.local
                default_domain = domain.local
        }

[domain_realm]
        .domain.local = DOMAIN.LOCAL
        domain.local = DOMAIN.LOCAL

[login]
        krb4_convert = true
        krb4_get_tickets = false

debian squeeze linux-2.6.32-5-amd64
samba-3.5.6
libkrb5-3 1.8.3+dfsg-4
wbinfo -g -u группы и пользователей кажет на ура
в домен введен, пробелемы на этом этапе были исправлены
обратную зону прописал в ручную, ошибка исчезла, НО юзера не идентифицирует
логи самбы:

[2011/02/22 15:40:17.948154,  3] libads/authdata.c:304(decode_pac_data)
  Found account name from PAC: ivanov_ii [Иванов Иван Иванович]
[2011/02/22 15:40:17.948189,  3] smbd/sesssetup.c:338(reply_spnego_kerberos)
  Ticket name is [ivanov_ii@DOMAIN.LOCAL]
[2011/02/22 15:40:17.948241,  5] lib/username.c:133(Get_Pwnam_alloc)
  Finding user DOMAIN/ivanov_ii
[2011/02/22 15:40:17.948253,  5] lib/username.c:77(Get_Pwnam_internals)
  Trying _Get_Pwnam(), username as lowercase is domain/ivanov_ii
[2011/02/22 15:40:17.948295,  5] lib/username.c:85(Get_Pwnam_internals)
  Trying _Get_Pwnam(), username as given is DOMAIN/ivanov_ii
[2011/02/22 15:40:17.948331,  5] lib/username.c:95(Get_Pwnam_internals)
  Trying _Get_Pwnam(), username as uppercase is DOMAIN/IVANOV_II
[2011/02/22 15:40:17.948366,  5] lib/username.c:104(Get_Pwnam_internals)
  Checking combinations of 0 uppercase letters in domain/ivanov_ii
[2011/02/22 15:40:17.948388,  5] lib/username.c:110(Get_Pwnam_internals)
  Get_Pwnam_internals didn't find user [DOMAIN/ivanov_ii]!
[2011/02/22 15:40:17.948399,  5] lib/username.c:133(Get_Pwnam_alloc)
  Finding user ivanov_ii
[2011/02/22 15:40:17.948408,  5] lib/username.c:77(Get_Pwnam_internals)
  Trying _Get_Pwnam(), username as lowercase is ivanov_ii
[2011/02/22 15:40:17.948441,  5] lib/username.c:95(Get_Pwnam_internals)
  Trying _Get_Pwnam(), username as uppercase is IVANOV_II
[2011/02/22 15:40:17.948476,  5] lib/username.c:104(Get_Pwnam_internals)
  Checking combinations of 0 uppercase letters in ivanov_ii
[2011/02/22 15:40:17.948488,  5] lib/username.c:110(Get_Pwnam_internals)
  Get_Pwnam_internals didn't find user [ivanov_ii]!
[2011/02/22 15:40:17.948553,  1] smbd/sesssetup.c:454(reply_spnego_kerberos)
  Username DOMAIN/ivanov_ii is invalid on this system
[2011/02/22 15:40:17.948572,  3] smbd/error.c:80(error_packet_set)

#======================= Global Settings =======================

[global]

    workgroup = domain
    realm = DOMAIN.LOCAL
    server string = Backup Server1
    dns proxy = yes
    interfaces = 192.168.99.5
    bind interfaces only = yes
    log file = /var/log/samba/log.%m
    allow trusted domains = No
    log level = 9
    max log size = 1000
    syslog only = no
    syslog = 0
    security = ADS
    encrypt passwords = true
    unix charset = LOCALE
    netbios name = SBA1
    passdb backend = tdbsam
    unix password sync = no
    domain logons = no
    preferred master = no
    local master = no
    load printers = no
    domain master = no
    password server = dc1.domain.local
    idmap uid = 10000-20000
    idmap gid = 10000-20000
    idmap backend = idmap_rid:TDTOBOL=10000-20000
    template shell = /bin/bash
    winbind enum groups = yes
    winbind enum users = yes
    winbind use default domain = yes
    winbind nested groups = Yes
#    auth methods = winbind
    usershare max shares = 100
    winbind separator = /
    os level = 0
#    use kerberos keytab = yes
    client NTLMv2 auth = yes
#    kerberos method = system keytab
    socket options = TCP_NODELAY SO_SNDBUF=8192 SO_RCVBUF=8192 IPTOS_THROUGHPUT
....
....
#======================= Share Definitions =======================

[backup]
    comment = Backup Directories
    browseable = no
    read only = yes
    create mask = 0700
    directory mask = 0700
    valid users = @"пользователи домена"

.....