pam_winbind reports misleading "Access denied"

[Andreas Heinlein]

Binary package hint: samba

We have a networked environment with passdb in LDAP, and the Ubuntu clients act as samba clients in a samba domain. When you install winbind and libnss-ldap/libpam-ldap, /etc/pam.d/common-auth looks like this:

auth [succes=3 default=ignore] pam_unix.so
auth [success=2 default=ignore] pam_winbind.so
auth [success=1 default=ignore] pam_ldap.so

That means "try local passdb first, then winbind, then LDAP". In our case, pam_unix.so fails silently, and pam_winbind should, too. But instead, pam_winbind reports "Access denied" to the user. This does not harm much, since authentication works anyway, but it is quite irritating. Even adding "silent" parameter to pam_winbind did not help. Please fix this.