Resolved. Confusion between samba, ldap, and unix passwords on the samba-ldap directory machine. Forcing a reset cleaned it all up.