slapd.conf:

include         /usr/local/etc/openldap/schema/core.schema
include         /usr/local/etc/openldap/schema/cosine.schema
include         /usr/local/etc/openldap/schema/inetorgperson.schema
include         /usr/local/etc/openldap/schema/misc.schema
include         /usr/local/etc/openldap/schema/nis.schema
include         /usr/local/etc/openldap/schema/openldap.schema
include         /usr/local/etc/openldap/schema/samba.schema
include         /usr/local/etc/openldap/schema/corba.schema
include         /usr/local/etc/openldap/schema/local.schema
include         /usr/local/etc/openldap/schema/pgp-keyserver.schema
include         /usr/local/etc/openldap/schema/pgp-recon.schema
include         /usr/local/etc/openldap/schema/pgp-remte-prefs.schema

loglevel 256

pidfile         /var/run/openldap/slapd.pid
argsfile        /var/run/openldap/slapd.args

# Load dynamic backend modules:
modulepath      /usr/local/libexec/openldap
moduleload      back_bdb
moduleload      syncprov

sizelimit 500

#######################################################################
# BDB database definitions
#######################################################################

backend         bdb
database        bdb
suffix          "dc=mylocaldomain,dc=ru"
rootdn          "cn=root,dc=mylocaldomain,dc=ru"
rootpw          {SSHA}xxxxxxxxxxxxxxxxxxxxx

directory       /var/db/openldap-data

replica host=172.16.0.69:389
    binddn="cn=replicator,dc=mylocaldomain,dc=ru"
    bindmethod=simple
    credentials=xxxxxxxxx

overlay syncprov
syncprov-checkpoint 10 10
syncprov-sessionlog 100

# let PGP discover the keystore base DN
access to dn="cn=pgpServerInfo,dc=mylocaldomain,dc=ru"
    by * read

access to dn.subtree="ou=PGP Keys,dc=mylocaldomain,dc=ru"
    by peername.ip=xxx.xxx.xxx.xxx write
    by peername.ip=xxx.xxx.xxx.xxx write
    by peername.ip=xxx.xxx.xxx.xxx write
    by peername.ip=127.0.0.1 write
    by * read

access to attrs=userPassword
    by dn="cn=root,dc=mylocaldomain,dc=ru" write
    by self write
    by anonymous auth
    by * none

access to attrs=sambaLMPassword,sambaNTPassword
    by dn="cn=root,dc=mylocaldomain,dc=ru" write
    by self write
    by anonymous auth
    by * none

access to *
    by dn="cn=root,dc=mylocaldomain,dc=ru" write
    by self write
    by * read

index   objectClass,uid,uidNumber,gidNumber     eq
index   cn,mail,surname,givenname               eq,subinitial
index   sambaSID                                eq
index   sambaPrimaryGroupSID                    eq
index   sambaDomainName                         eq
index   entryCSN                                eq
index   entryUUID                               eq

nss_ldap.conf:

base dc=mylocaldomain,dc=ru

bind_policy soft

bind_timelimit 10

host 127.0.0.1

ldap_version 3

nss_base_group  ou=Group,ou=Samba,dc=mylocaldomain,dc=ru?one
nss_base_passwd ou=Users,ou=Samba,dc=mylocaldomain,dc=ru?one
nss_base_passwd ou=Computers,ou=Samba,dc=mylocaldomain,dc=ru?one
nss_base_shadow ou=Users,ou=Samba,dc=mylocaldomain,dc=ru?one

nss_connect_policy persist
nss_paged_results yes

port 389

scope one

timelimit 30

uri ldap://127.0.0.1

directory       /var/db/openldap-data

suffix          "dc=mylocaldomain,dc=ru"
rootdn          "cn=root,dc=mylocaldomain,dc=ru"
rootpw          {SSHA}xxxxxxxxxxxxxxxxxxxxxxxxx

#binddn cn=root,dc=mylocaldomain,dc=ru
#bindpw xxxxxxxxxxxxxx

pam_filter objectclass=posixAccount
pam_login_attribute uid
pam_member_attribute gid
pam_password crypt

index cn, sn, uid, gidnumber pres, eq, approx
index objectclass pres,eq
dbcachesize 500000
index default none

smb.conf:

[global]
#   host msdfs = yes
    workgroup = OD-TEST
    server string = BDC
    security = user
    hosts allow = xxx.xx. 127.
;   load printers = yes
;   printcap name = /etc/printcap
;   printcap name = lpstat
;   printing = cups
;   guest account = pcguest
    log file = /var/log/samba/log.%m
    max log size = 500
;   password server = <NT-Server-Name>
;   realm = MY_REALM
#   passdb backend = smbpasswd
    passdb backend = ldapsam:ldap://localhost/

    ldap delete dn                = Yes
    ldap ssl                      = off
    ldap passwd sync              = Yes
    ldap suffix                   = dc=mylocaldomainl,dc=ru
    ldap machine suffix           = ou=Computers,ou=Samba
    ldap user suffix              = ou=Users,ou=Samba
    ldap group suffix             = ou=Group,ou=Samba
    ldap idmap suffix             = ou=Idmap,ou=Samba
    ldap admin dn                 = cn=root,dc=mylocaldomain,dc=ru
    idmap backend                 = ldap:ldap://localhost
    idmap uid                     = 10000-20000
    idmap gid                     = 10000-20000

    winbind uid = 10000-20000
    winbind gid = 10000-20000
    winbind separator = @
    winbind use default domain = yes

;   include = /usr/local/etc/smb.conf.%m
    socket  options  =  TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

    interfaces = xxx.xxx.xxx.xxx/xx
    local master = no
    os level = 65
    domain master = yes
    preferred master = yes
    domain logons = yes
;   logon script = %m.bat
;   logon script = %U.bat
    logon script = netlogon.cmd
;   logon path = \\%L\Profiles\%U

    wins support = yes
;   wins server = w.x.y.z
;   wins proxy = yes
    dns proxy = no

;   display charset = koi8-r
;   unix charset = koi8-r
;   dos charset = cp866
    display charset = utf-8
    unix charset = utf-8
    dos charset = cp866

# Use extended attributes to store file modes
;    store dos attributes = yes
;    map hidden = no
;    map system = no
;    map archive = no

# Use inherited ACLs for directories
;    nt acl support = yes
;    inherit acls = yes
;    map acl inherit = yes

# These scripts are used on a domain controller or stand-alone
# machine to add or delete corresponding unix accounts
;  add user script = /usr/sbin/useradd %u
;  add group script = /usr/sbin/groupadd %g
;  add machine script = /usr/sbin/adduser -n -g machines -c Machine -d /dev/null -s /bin/false %u
;  delete user script = /usr/sbin/userdel %u
;  delete user from group script = /usr/sbin/deluser %u %g
;  delete group script = /usr/sbin/groupdel %g

    add machine script = /usr/local/sbin/ldapaddmachine '%u' computers
    add user script = /usr/local/sbin/ldapadduser '%u' users
    add group script = /usr/local/sbin/ldapaddgroup '%g'
    add user to group script = /usr/local/sbin/ldapaddusertogroup '%u' '%g'
    delete user script = /usr/local/sbin/ldapdeleteuser '%u'
    delete group script = /usr/local/sbin/ldapdeletegroup '%g'
    delete user from group script = /usr/local/sbin/ldapdeleteuserfromgroup '%u' '%g'
    set primary group script = /usr/local/sbin/ldapsetprimarygroup '%u' '%g'
    rename user script = /usr/local/sbin/ldaprenameuser '%uold' '%unew'                                    

    encrypt passwords = yes

    time server = Yes

    logon home =
    logon path =

    syslog = LOG_DEBUG

    winbind enum groups = yes
    winbind enum users = yes

    winbind use default domain = yes

    # off port 445
    smb ports = 139

    netbios name = BDC

;    netbios aliases = xxxx

    # наследовать владельца (вышестоящей директории)
    inherit owner           = yes
    # наследовать ACL
    inherit acls            = yes
    # наследовать права
    inherit permissions     = yes
    # позвоялет редактору прав из винды корректно обрабатывать
    # наследуемые права
    map acl inherit         = yes

#============================ Share Definitions ==============================