Thanks for the suggestions so far!
I'm documenting this on this thread because I found out why the previous system had the custom sambaSamAccount attributes: They seem to be necessary to authenticate SMB shares when FreeIPA is the LDAP backend to a Synology NAS. If I try to set LDAP authentication now, I get this error on Synology DSM:
> Issue Details: The LDAP server does not support Samba schema.
> ...
> Recommended action: Enable CIFS plain text password authentication. [and if you do], this DSM cannot be the remote mount target of CIFS.
Some past threads on freeipa-users (mostly for TrueNAS) suggest that the Samba schema attributes are deprecated in favour of something using Kerberos, but I do not get that option in Synology at all.
I believe the previous sysadmins of our shop must have followed this guide by Markus Opolka, or a similar HOWTO:
That would explain why I couldn't create users with the Web interface in my new FreeIPA (4.11) instance; this guide necessitates manual setting of the Samba attributes via command-line `ipa user-add` flags.
However, it is then a mystery to me why user account creation worked via Web interface in the old (4.5) instance.
I'm not sure how to proceed here since CIFS mounting is one of our users' primary uses of LDAP in the first place. Maybe I'll recreate the Samba attributes after all, try to restore the previous values from backups, and document properly how to create users with the command-line options.
[]s