quick samba and winbind question

As I understand it from the documentation I've been reading (but haven't 
had a chance to put into practice), I can use samba 3 and winbind to have a 
linux box automatically create accounts on the workstation as people log in 
for the first time based on accounts in an Active Directory tree.  Can I 
make it so that only accounts in a specific ou or group in AD are autocreated?

This is what I have in mind:  Our university has an AD forest and our 
department has it's own ou with our users in the ou.  We can create 
arbitrary groups in the ou and add anyone with an account in the 
forest.  I'd like to set up an email server that only serves mail for users 
in our ou or who are in a group that I designate.  So I create an AD 
account on Monday, [email protected]  Foo never logs in to check mail.  I send 
[email protected] an email.  The bar.com server receives the mail and creates it 
for the user because foo is either in our ou or in the group.  That's the 
ideal.  If the bar.com server would only create the account *after* foo 
checks mail for the first time, that would be acceptable.  What I don't 
want is user oof, who is in a different ou, to be able to check mail on the 
server.

I can't quite see how to do this exactly, but I'm very new.  The two things 
I'm thinking of at this point is if I could either:

1)  set a filter somewhere so that the machine only looks in 
ou=myplace;dn=uiowa to restrict it to the "myplace" ou.

2)  use the group mappings feature of winbind to explicitly map 
"myemailgroup" to id 20000 (or whatever) and then doesn't allow any other 
group to map ids.

But I'm not sure those will work.  Any ideas on this?

Thanks,

bob

======================================================================
Bob Ramsey          SYSTEMS ADMINISTRATION AND SYSTEMS PROGRAMMING III
ph:  1(319)335-9956                              187 Boyd Law Building
fax: 1(319)335-9019                  University of Iowa College of Law
mailto:[email protected]                Iowa City, IA 52242-1113
For Hardware and Software questions, call 5-9124
======================================================================
_______________________________________________
LinuxManagers mailing list - http://www.linuxmanagers.org
submissions: LinuxManagers-35TzE1X9F6582KRnZfj+bdi2O/[email protected]
subscribe/unsubscribe: http://www.linuxmanagers.org/mailman/listinfo/linuxmanagers