You should be debugging the Samba server. The error you're getting seems to be a generic catch all.
Keep in mind that all adbindproxy does is to resolve the identities (users/groups/memberships, UIDs and GIDs). As long as you're getting the right identity back from adclient and adbindproxy our work is done.
I would also rule out the existance of a local user with the same name as a final check; in addition, can you make sure that you have a Kerberos TGT prior to running smbclient?
1. Log in as user2 in the Samba Server
2. Run /usr/share/centrifydc/kerberos/bin/klist
(do you see a TGT? if not, go to 3, if yes, go to 4)
3. Run /usr/share/centrifydc/kerberos/bin/kinit - type the password when prompted.
4. Run the smbclient command and report results.
Do the same when accessing remotely.
Good luck!