Do Windows clients need CALs when using Samba for Active Directory?

Generally, no. CALs are Microsoft licensing requirements for accessing services hosted on Windows Server. If Samba is running on a non-Windows operating system and provides the directory services, the Windows clients do not normally require Windows Server CALs just because they authenticate against Samba.

The important distinction is the server platform, not whether the service behaves like Active Directory. Samba itself doesn't require Microsoft CALs. If you add even one Windows Server instance, though, that server's licensing rules may apply to users or devices accessing services such as DHCP or DNS, with some service-specific exceptions.

Think of a CAL as being tied to access to a Windows Server, rather than to the Windows workstations. A Windows client connecting to Samba doesn't create a CAL obligation by itself. For a production environment, it’s still worth checking the exact Microsoft licensing terms or getting professional licensing advice if Windows Server or other Microsoft server products are involved.