It's not clear what you mean by map as a local user. There's any number of ways to get AD-managed users able to authenticate to an EL-based host (pure LDAP, pure Kerberos, winbind, SSSD, third-party tools). Beauty of PAM is that you can even use multiple methods at the same time. As long as your application (in this case, Samba) knows what to do with the POSIXized userids that the AD-binding service provides to the OS, there typically really isn't any need to literally create a local user mapped to the remote auth-service.