I'm using Winbind to authenticate users to Active Directory. Everything is working perfectly when the usernames match. The problem is that many of the users have different usernames for Windows and Linux (grandfathered accounts and engineers are stubborn about change). For the most part I can get around this by giving openLDAP 2 unique UIDs to the same DN. For example:[bob.smith@myhost ~]$ ldapsearch -xLLL uid=bobdn: uid=bob.smith,dc=example,dc=comuid: bob.smithuid: bobobjectClass: inetOrgPersonobjectClass: posixAccountobjectClass: shadowAccountloginShell: /bin/bashuidNumber: 4563cn: Bob SmithhomeDirectory: /home/bobshadowMin: 0shadowMax: 999999shadowWarning: 7shadowInactive: 0shadowExpire: 24837sn: Smithmail: bob.smith@example.comgidNumber: 555shadowLastChange: 17044Now log in with openLDAP password and run whoami[bob.smith@myhost bob]$ su - bobPassword: Last login: Wed Sep 21 10:09:22 PDT 2016 on pts/3[bob.smith@myhost ~]$ whoamibob.smithCheck the user id[bob.smith@myhost ~]$ id bobuid=4563(bob.smith) gid=555(AGROUP) groups=555(AGROUP),988(x2gouser),19775215(domain users)Everything looks great right? That is until I try to log in as bob and not the Windows name of bob.smith and use the AD password (bob.smith can log in fine):[bob.smith@myhost ~]$ su - bobPassword: su: Authentication failureAs far as I can tell PAM is configured correctly and as I've shown before the system acknowledges that user as bob.smith even when I log in as bob. But authentication doesn't see bob as a valid user.[bob.smith@myhost ~]$ cat password-auth #%PAM-1.0# This file is auto-generated.# User changes will be destroyed the next time authconfig is run.auth        required      pam_env.soauth        sufficient    pam_unix.so nullok try_first_passauth        requisite     pam_succeed_if.so uid >= 1000 quiet_successauth        sufficient    pam_krb5.so use_first_passauth        sufficient    pam_ldap.so use_first_passauth        sufficient    pam_winbind.so krb5_auth krb5_ccache_type=KEYRING use_first_passauth        required      pam_deny.soaccount     required      pam_unix.so broken_shadowaccount     sufficient    pam_localuser.soaccount     sufficient    pam_succeed_if.so uid < 1000 quietaccount     [default=bad success=ok user_unknown=ignore] pam_ldap.soaccount     [default=bad success=ok user_unknown=ignore] pam_krb5.soaccount     [default=bad success=ok user_unknown=ignore] pam_winbind.so krb5_auth krb5_ccache_type=KEYRINGaccount     required      pam_permit.sopassword    requisite     pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type=password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtokpassword    sufficient    pam_krb5.so use_authtokpassword    sufficient    pam_ldap.so use_authtokpassword    sufficient    pam_winbind.so krb5_auth krb5_ccache_type=KEYRING use_authtokpassword    required      pam_deny.sosession     optional      pam_keyinit.so revokesession     required      pam_limits.so-session     optional      pam_systemd.sosession     [success=1 default=ignore] pam_succeed_if.so service in crond quiet use_uidsession     required      pam_unix.sosession     optional      pam_krb5.sosession     optional      pam_ldap.sosession     optional      pam_winbind.so krb5_auth krb5_ccache_type=KEYRINGHere is my smb.conf file if it makes a difference:[bob.smith@myhost ~]$ testparmLoad smb config files from /etc/samba/smb.confrlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)Processing section [homes]Processing section [printers]Loaded services file OK.Server role: ROLE_DOMAIN_MEMBERPress enter to see a dump of your service definitions# Global parameters[global]        workgroup = EXAMPLE-USA        realm = EXAMPLE.COM        server string = Samba Server Version %v        security = ADS        kerberos method = secrets and keytab        log file = /var/log/samba/log.%m        max log size = 50        winbind use default domain = Yes        idmap config * : range = 16777216-33554431        idmap config * : backend = tdb        cups options = raw[homes]        comment = Home Directories        read only = No        browseable = No[printers]        comment = All Printers        path = /var/spool/samba        printable = Yes        print ok = Yes        browseable = NoIf there is a fix on the Linux end that would be preferable as I'm not a Windows Domain Admin. But if someone has a solution from the Windows side I'm willing to explore that option. If there are no valid solutions then I'll look into syncing the openLDAP password with the AD password. It would essentially be the same as an end result. 
Using alernative openLDAP UID to authenticate to Active Directory
linux;samba;authentication;active directory;winbind