Windows domain account can't create files via samba share, but can do this in linux shell, why?

Question

I'm migrating tomcat server from windows to linux (CentOS 6.3 64bit), and want to use samba to share tomcat directory to technical department staffs (windows domain users) with read+write rights.

I've setup kerberos & winbind & samba successfully, and did the following permission settings:

# add some domain users to local 'tech' group
group add --gid 777 tech
groupmems --group tech --add liu.yan
groupmems --group tech --add MY-DOMAIN\\liu.yan

# change owner & mode of tomcat directory
chown tomcat:tomcat /var/lib/apache-tomcat-6.0.35
chmod 6755 /var/lib/apache-tomcat-6.0.35
cd /var/lib
ln -s apache-tomcat-6.0.35 tomcat6

# add ACL entry
setfacl --modify group:tech:rwx /var/lib/apache-tomcat-6.0.35

Check permission setting, and use windows domain user account create file/directory -- successfully

[root@webserver apache-tomcat-6.0.35]# pwd
/var/lib/apache-tomcat-6.0.35

[root@webserver apache-tomcat-6.0.35]# getfacl /var/lib/apache-tomcat-6.0.35/
getfacl: Removing leading '/' from absolute path names
# file: var/lib/apache-tomcat-6.0.35/
# owner: tomcat
# group: tomcat
# flags: ss-
user::rwx
group::r-x
group:tech:rwx
mask::rwx
other::r-x

[root@webserver apache-tomcat-6.0.35]# su liu.yan
[liu.yan@webserver apache-tomcat-6.0.35]$ mkdir temp-dir
[liu.yan@webserver apache-tomcat-6.0.35]$ touch temp-file.txt
[liu.yan@webserver apache-tomcat-6.0.35]$ getfacl temp-*
# file: temp-dir
# owner: liu.yan
# group: tomcat
# flags: -s-
user::rwx
group::r-x
other::r-x

# file: temp-file.txt
# owner: liu.yan
# group: tomcat
user::rw-
group::r--
other::r--

Create file/directory via samba share -- failed

[root@webserver apache-tomcat-6.0.35]# smbclient -U liu.yan //localhost/tomcat6
Enter liu.yan's password:
Domain=[MY-DOMAIN] OS=[Unix] Server=[Samba 3.5.10-125.el6]

smb: \> mkdir temp-dir2-via-samba-share
NT_STATUS_MEDIA_WRITE_PROTECTED making remote directory \temp-dir2-via-samba-share

If I changed the mode of /var/lib/apache-tomcat-6.0.35/ directory to 777, then I CAN create file/directory in samba share on Windows clients, but CAN NOT do this via smbclient tool.

Why ?

[tomcat6] share setting in smb.conf

[tomcat6]
    comment = Tomcat 6
    path = /var/lib/tomcat6
    public =yes
    write list = root,@tomcat,@tech