Solaris

Uhm...

A samba-server can authenticate it's users against an LDAP database. Sorry, but are you pulling my leg?

Windows user browses the network environment, chooses a samba-server, clicks on it, the server prompts for a username and password. When the password is correct, the server will permit access to the shares the user is granted access on. That's the way it's worked for the last 15 years?

See Samba & LDAP - SambaWiki for a linux-samba.

How do you authenticate users on a samba-server, if you've ever done so yet?

Okay, I understand what you really want is to map Windows SIDs to Unix UIDs. I don't think the ZFS/CIFS OpenSolaris service allows interactive (one shot?) mappings like you explain in your previous posting.
What you might do instead is to add attributes to either the active directory server used to authenticate your users on the Windows side or to an LDAP directory server on the Unix side or simply to add static rules to map ids. Have a look at the idmap manual page for details.

This document is also explaining how that service works:

Preface - Solaris CIFS Administration Guide

Yes, now we are speaking the same language.

But this is such a complex topic, completely different from old samba-style, that's why I wonder, if there isn't any easy to follow tutorial out there, as I am not excited about each and every detail...

If you want to go the static mappings way, which is simpler to set up, you can use the syntax described in the manual page. eg.:

Code:

idmap add winname:PatrickBaer unixuser:pbaer

or, if your unix and windows usernames are identical:

Code:

idmap add 'winuser:*' 'unixuser:*'

True, but in this setup I had to add a unix-user for every account, which is exactly what I do NOT want.

It should be as simple as "Lookup user/pass in LDAP => Authentication ok? => User in the right group to access the share => connect"

That way I can easily add a new server and just tell it, to do the same thing.

Why ? That's the way it's designed. If a user create a file on a shared filesystem, that file should belong to that user which then must be know by the OS.
In any case, you tell your users are authenticating to an ldap directory so you are probably close to be set. Assuming your LDAP schema is properly configured to allow unix authentication (eg: having PosixAccount and shadowAccount object classes), you might simply need to configure the cifs server to be an ldap name service client.
Is this what you are looking for or am I still missing something ?

Nope, now we are finally speaking the same language

---------- Post updated at 09:05 AM ---------- Previous update was at 08:12 AM ----------

I just heard, company will probably user a windows active directory instead of LDAP. Sad, but we will see what really happens...