Ldap – How config samba to use ladp attr “userPassword” password OR config ldap when attr “userPassword” changed then “sambaNTPassword” will be changed too

ldapsamba

I installed samba-4.1.12-24.el7_1.x86_64 and openldap-2.4.39-7.el7.centos.x86_64 and self-service-password for ladp user change their password.

I noticed self-service-password will change ldap attr userPassword 's value.

After config smaba, now from my windows PC , I can login to \fileserver\shared with account exsit in ldap successful.

But looks like samba will use sambaNTPassword as user password
So, my question is:
1. Is it possible to config samba use ldap attr userPassword as password?
2. If quesiton 1 answer is NO, Is there any way when user change ldap attr userPassword from self-service-password, then sambaNTPassword will be changed too?

one of user info in ldap are:

dn: uid=test,ou=people,dc=example,dc=com
objectClass: inetOrgPerson
objectClass: sambaSamAccount
objectClass: posixAccount
ou: people
cn: test
sn: test
uid: test
userPassword: {SHA}fEqNCco3Yq9h5ZUglD3CZJT4lBs=
mail: test@test.com
sambaSID: S-1-5-21-2877438406-135960529-4133751732-1102
sambaNTPassword: 9b33b03590e779419a0a162519590025
sambaPwdLastSet: 1447826752
uidNumber: 1102
homeDirectory: /home/test
sambaPrimaryGroupSID: S-1-5-21-2877438406-135960529-4133751732-5000
gidNumber: 5000

samba config:

     testparm 
    Load smb config files from /etc/samba/smb.conf
    rlimit_max: increasing rlimit_max (1024) to minimum Windows limit (16384)
    Processing section "[homes]"
    Processing section "[printers]"
    Processing section "[shared]"
    Loaded services file OK.
    Server role: ROLE_STANDALONE
    Press enter to see a dump of your service definitions

    [global]
            workgroup = DY-FILESERVER
            netbios name = SMBSERVER
            server string = Samba Server Version %v
            passdb backend = ldapsam:ldap://localhost
            log file = /var/log/samba/log.%m
            max log size = 50
            ldap admin dn = cn=root,dc=example,dc=com
            ldap suffix = dc=example,dc=com
            ldap user suffix = ou=people
            idmap config * : backend = tdb
            cups options = raw

    [homes]
            comment = Home Directories
            read only = No
            browseable = No

    [printers]
            comment = All Printers
            path = /var/spool/samba
            printable = Yes
            print ok = Yes
            browseable = No

    [shared]
            comment = shared dir for ldap users
            path = /opt/ftpdata
            writable = yes
            read only = No

Best Answer

Sorry, I didn't read the full doc of self-service-password, it can be configed to change too

$samba_mode = true;

after this config, self-service-password will change both attribute userPassword sambaNTpassword