I've set up winbind according to the instructions at http://www.flatmtn.com/article/setting-samba

However, I disabled the 'winbind [ug]id' and 'winbind enum {users|groups}' config settings, and the part in nsswitch.conf. I don't know how many hours it's acceptable for a simple 'id' command to take, but I wasn't willing to wait that long. I only really care about a single user anyway -- so I created a local user with that name, and it mostly seems to work.

I've enabled 'cached credentials' in smb.conf (winbind offline login) and pam_winbind.conf:

[global]
debug = yes
debug_state = yes
cached_login = yes
krb5_auth = yes
krb5_ccache_type = FILE

I can log in as user 'dwoodhou', and I get a Kerberos ticket and everything seems happy... until I run ntlm_auth, and it still asks me for a password:
ntlm_auth --domain GER --username dwoodhou --helper-protocol ntlmssp-client-1 --use-cached-creds -d10
YR
PW

This seems to happen because we're caching the credentials with the bare username, but ntlm_auth is looking them up with the string DOMAIN\username and thus failing to find them. That seems to be 'fixed' by this patch:

--- source3/winbindd/winbindd_pam.c~	2010-06-18 13:01:04.000000000 +0100
+++ source3/winbindd/winbindd_pam.c	2010-07-26 12:11:23.657507372 +0100
@@ -1489,7 +1489,7 @@ enum winbindd_result winbindd_dual_pam_a
 
 	parse_domain_user(mapped_user, name_domain, name_user);
 
-	if ( mapped_user != state->request->data.auth.user ) {
+	if ( 1 || mapped_user != state->request->data.auth.user ) {
 		fstr_sprintf( domain_user, "%s\\%s", name_domain, name_user );
 		safe_strcpy( state->request->data.auth.user, domain_user,
 			     sizeof(state->request->data.auth.user)-1 );

However, it's only working while I'm online. If I kill winbindd, disconnect from the VPN and restart it (simulating a reboot), I can no longer log in. It seems that the disk cache is missing. I see this in winbindd output...

winbindd_validate_cache: replacing panic function
tdb_validate_open called for tdb '/var/lib/samba/winbindd_cache.tdb'
tdb_validate called for tdb '/var/lib/samba/winbindd_cache.tdb'
tdb_validate: forking to let child do validation.
tdb_validate: fork succeeded, child PID = 10213
tdb_validate: waiting for child to finish...
tdb_validate (validation child): created
tdb_validate (validation child): calling tdb_validate_child
tdb_validate_child: summary of validation status:
 * tdb error: yes
 * bad freelist: no
 * bad entry: no
 * unknown key: no
 => overall success: no
tdb_validate: validating child returned.
tdb_validate: child exited, code 255.
tdb_validate returning code '255' for tdb '/var/lib/samba/winbindd_cache.tdb'
tdb '/var/lib/samba/winbindd_cache.tdb' is invalid
Could not stat '/var/lib/samba/winbindd_cache.tdb.bak': No such file or directory
No backup found.
moved '/var/lib/samba/winbindd_cache.tdb' to '/var/lib/samba/winbindd_cache.tdb.corrupt'
Corrupt tdb stored as '/var/lib/samba/winbindd_cache.tdb.corrupt'
winbindd_validate_cache: validation not successful.
removing tdb /var/lib/samba/winbindd_cache.tdb.
winbindd_validate_cache: restoring panic function
winbindd cache tdb corrupt and no backup could be restored.
initialize_winbindd_cache: clearing cache and re-creating with version number 1

This is entirely repeatable -- every time I restart winbindd it declares that its previous cache database is corrupt and creates a new one.

Furthermore, even if I *connect* to the VPN I still can't log in; I have to restart winbindd after reconnecting to the VPN before it'll let me log in.