Добрый день

на самбе сделал  шару с авторизацией в АД
там группа универсальная, в которой есть пользователи в основном домене domain.local и из поддомена sub.domain.local
на шару пускает только тех кто в основном домене.
как сделать что бы пользователи из поддомена могли заходить на шару.

smb.conf
[global]
    workgroup = JSC-TAIFNK
    realm = JSC-TAIFNK.LOCAL
    security = ads
    auth methods = winbind
    allow trusted domains = yes
    
    log level = 2
    log file = /var/log/samba/%m.%U.log
    
    netbios name = ibs    
    server string =
    encrypt passwords = yes
    
    load printers = no
    show add printer wizard = no
    
    case sensitive = No
    
    winbind gid = 10000-20000
    winbind uid = 10000-20000
    
    #winbind use default domain = yes
    winbind enum users = yes
    winbind enum groups = yes
    winbind refresh tickets = yes
    
    wins support = yes
    wins server = 172.30.0.241
    
    template shell = /bin/bash
    template homedir = /home/%U
    
    password server = 172.30.0.240
    
    socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192

[ibs share]
    comment = IBS share
    path = /files/ibs share/
    read only = No
    nt acl support = Yes
    inherit acls = yes
    inherit owner = yes
    inherit permissions = yes
    
    map acl inherit = yes
    map archive = no
    map read only = no
    
    locking = no    
    
    create mask = 0660
    directory mask = 0770
    
    read list = "@JSC-TAIFNK.LOCAL\gr"
    write list =  "@JSC-TAIFNK.LOCAL\gr"
    valid users =  "@JSC-TAIFNK.LOCAL\gr"
    
    admin users = "@JSC-TAIFNK.LOCAL\share admin"

krb5.conf

[libdefaults]
    default_realm = JSC-TAIFNK.LOCAL
    clockskew = 300

[realms]
JSC-TAIFNK.LOCAL = {
    kdc = selena.jsc-taifnk.local
    default_domain = jsc-taifnk.local
    admin_server = selena.jsc-taifnk.local
}

    
[domain_realm]
    .jsc-taifnk.local = JSC-TAIFNK.LOCAL
    
[logging]
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON

[appdefaults]
pam = {
    ticket_lifetime = 1d
    renew_lifetime = 1d
    forwardable = true
    proxiable = false
    retain_after_close = false
    minimum_uid = 1
    try_first_pass = true
}

nsswitch.conf

passwd:    files winbind
group:    files winbind
shadow:    files winbind

hosts:    files dns
networks:    files

services:    files
protocols:    files
rpc:    files
ethers:    files
netmasks:    files
netgroup:    files nis
publickey:    files

bootparams:    files
automount:    files nis
aliases:    files