Help coming up with a plan

Question

Hi everyone. I hope to make this quick to read, and to respond. I'm brand new to OS X Server (but not client) and am trying to get a handful of services going for my company. It's not too complex, but with things like Open Directory being completely new to me, it's becoming more complicated than I originally thought it would be.
Again, I'll do my best to keep this simple...
Background:
Our company has less than 20 people across three cities. Every single user is using a laptop. We frequently travel between offices, and the country to meet with clients. Our OS X Server is co-located in another state.
Priorities:
First is the wiki because our wiki host has kind of vanished from the internet. I quickly discovered that you have to use Open Directory. After disabling SSL and creating users and groups, the wiki is now working. So we're good here!
Second is file sharing. I'd like it so if you're part of the "NY" group in OD, you can see and mount the NY shared folder, but not the "DC" folder. However, it appears to me, in Server Admin.app, that Share Point permissions are controlled by the server's local user rights and not Open Directory. Changing a group to NY, which does not exist on the local server group, did not make it visible to the user. I added a folder to each group in the Workgroup Manager but something tells me you have to log into your OS X client with OD in order to see those.
We wanted a shared Address Book server, so we could synchronize our address books, specifically client information (not each other within the company), but after my boss did some experimenting and now I'm reading information on Snow Leopard having an app called "Address Book Server", it looks like this is not going to be possible in Leopard Server, or at least easily.
Finally, our last big priority was iCal Server. Looks like there are no problems there once it's configured but I haven't gotten to it yet.
Since we don't have many users, should I try and configure each service individually and get them working, like I got the wiki working and then moved onto the file sharing, and stumble my way through, or should I start at the beginning and make all of our laptops authenticate with Open Directory and use Kerberos for SSO and go from there? It doesn't seem like we have much to gain from OD+Kerberos since we just need a few services for a handful of users, but if it's easier to set up and maintain, then I'm all for it.
If so, how do I do this for laptops that are not in the same LAN as the OS X Server? Most of the the documentation that Apple provides assumes you're working with local machines and the OS X Server DHCP is setting up the LDAP information when you log in. On my test MacBook, I added our colo'd server to Directory Utility under an admin-level account, and then logging in (via regular login window where you type in the name as password) with the short name of a user that existed in the OD but didn't have a local account and nothing happened. I may be misunderstanding how that is supposed to work
Based upon what I've read, I think it'd be easiest to go with Open Directory for logging in and authentication and Kerberos and all that, but all of our users have been using their laptops unrestricted for such a long time, I'm worried it may be difficult to suddenly switch to OD. I know there are several advantages to using OD for all of this, like Portable Home Directories and custom Docks and such, but without any experience, I'm afraid this may turn into a nightmare to set up and the payoff won't be worth the trouble (would be nice to have an excuse to travel though!). Because if I just set up the 4 items we've requested then my job is done, but if we add other services like email to this machine then changes have to then be made across 20 computers again.
What advice, short or detailed, would you give to someone in my position? I would sincerely appreciate any and all tips.

Answer 1

Hi
Seriously for the sake of brevity (in terms of this post) hire a consultant or someone who is capable of doing the work. ACTC or ACSA (if you are looking for qualified people) would do or someone who has lots of experience and practical knowledge without necessarily having the qualifications. These guys are worth their weight in gold and there are more of them around than one would think.
Based on your post what you are asking for is not difficult and should be achievable without too much fuss and within a reasonable amount of time.
From your point of view - presumably as the on-site 'designated' administrator - having someone there who 'knows what they are doing' will be of enormous benefit. You can ask questions, take notes etc.
My two cents.
Tony