Give users access to Samba by group

I have two groups: let's say "grprw" and "grpro". I'd like people in the "grprw" group to have read-write access to my share, I'd like people int the "grpro" group to have read-only access to the share, and don't want anyone outside those groups to have access, at all.

Among other things, I've tried:

Setting "valid users = DOMAIN\grprw DOMAIN\grpro" and "write list = DOMAIN\grprw"

Setting "valid users = @DOMAIN\grprw @DOMAIN\grpro" and "write list = @DOMAIN\grprw"

Setting "lxuserrw = DOMAIN\grprw" and "lxuserro = DOMAIN\grpro" in the username map file

Setting "lxuserrw = @DOMAIN\grprw" and "lxuserro = @DOMAIN\grpro" in the username map file

Mapping groups, using "net groupmap", and then using "valid users = @lxgrpro"

Mapping groups, using "net groupmap", and then setting "lxuserrw = @lxgrprw" in the username map file

None of those work. Anyone know what does?