When I come to point 4.3 I get:

ipa: ERROR: Unknown option: sambagrouptype

The only thing I’ve done differently (as far as I can tell) is that the samba server is a separate machine than the IPA-server but I’ve verified that it works so far that I can do, for example, getent passwd admin so apparently IPA itself is working properly.

Any suggestion what has gone wrong?

I too am frustrated by this behavior as I am also considering POSIX ACLs for this purpose. However, it turns out this is not a failure of ACLs.

This is a “failure” of cp. cp preserves mode, ownership, and timestamps by default. Thus, it seems there is no way to achieve what we want without some sort of user intervention, be it calling chmod/setfacl after cp or using the –no-preserve=mode option.

Personally, I am considering the cron job approach as this is the simplest way to do it, although this would incur some amount of latency since the task is periodic and not in response to file creation. Another approach would be to write a small daemon that uses something like dnotify to automatically enforce permissions on new files, but I’m feeling quite lazy…

PS: Bear in mind, that cp did not actually respect –no-preserve=mode until this year: http://savannah.gnu.org/bugs/?27146