Authenticated Bind succeeds but "This server is not responding"

Question

Hey everyone,
I have a "from scratch"  magic triangle setup. AD has 2 DC's in a domain named domain.priv, 1 Lion (10.7.4) OD server successfully bound to AD and authentication is working flawlessly and fast! There are a handful of clients running SL which have mobile homes. There are also a handful of Lion clients with mobile homes.  DNS is running on AD.
Here's the rub. I can bind the SL clients to AD and OD just fine.  I do an authenticated bind to OD so that it creates the computer record.  On the Lion clients I bind them to AD without a problem and OD without and error message however once I bind Directory Utility has a red light stating "This server is not responding".  Search paths are correct, pinging works the server works. Because authentication and mobile homes are working I think it's fairly safe to assume DNS is setup properly.
For clarification, I have a script that does the binding but I promise I've tried every available option in dsconfigldap without success.  I've obviously tried using the GUI as well with no luck.  I've tried turning on SSL and no SSL.  I've tried enabling other security options without success as well. A work around I have found for the Lion clients was first do an authenticated bind to create the computer record and add it to appropriate computer groups then unbind the client and rebind UNauthenticated. Binding without authentication works perfectly and the client never loses contact with the OD server.
The reason I am posting this problem is because I am finally getting around to adding a secondary OD server for replication. I do not have the option to do an unauthenticated bind with OS Server and I have not found a way to successfully setup a replica without binding first, obviously.
I will post log files as needed but I have not found anything that is out of the ordinary except for:
9/20/12 7:34:16.560 PM servermgrd: -[PasswordServerPrefsObject getSearchBase]: Unable to locate search base: -1 Can't contact LDAP server
9/20/12 7:34:16.562 PM servermgrd: -[PasswordServerPrefsObject loadXMLData]: Unable to locate passwordserver config record's plist attribute: -1 Can't contact LDAP server
9/20/12 7:34:16.564 PM servermgrd: -[PasswordServerPrefsObject getSearchBase]: Unable to locate search base: -1 Can't contact LDAP server
9/20/12 7:34:16.567 PM servermgrd: -[PasswordServerPrefsObject saveXMLData]: ldap_modify_ext_s of the passwordserver config record's plist attribute: -1 Can't contact LDAP server
It goes on like that...
Also, IPv6 is not setup on the AD DNS servers. Not sure that matters but I figured I should put it out there.
Any help or ideas of where to look would be greatly appreciated!  Thanks!
Nick.

Answer 1

I ended up opening a ticket with Apple and the cause has been identified and even a "fix"!
Turns out that I skipped a vital step prior to binding to AD or setting up the OD Master; preparing the server to connect to another directory.
It's necessary to go to Server Admin, select Open Directory, Settings, then Change. Select "Connect to another directory" and then continue. After that the normal steps should be taken; Connect to AD with Directory Utility and then Create Open Directory Master with Server Admin.
Since I have a test enviroment that consists of 1 week old backups of the AD Domain Controllers and OD Master I decided to destroy the current OD and start over and testing this out.  Guess what? Everything works as it should. Bount a couple of Lion clients, tested management, and even created a replica with the GUI!
Here's the rub...
In order to keep my current environment in tact (computers and computer groups) I exported all of the computers and computer groups from WGM prior to destroying the Open Directory Master. Once I completed setting everything up and created a new Directory Master I reimported the archive. With this method all currently I was back to square one. SL clients were bound, I could unbind and re-authenticaed bind with no problems. Lion clients however, had the same issue, could not bind with authentication. Fail.
I also tried exporting the computers and computer groups from WGM prior to destroying the Master. Set everything back up, imported the computers and computer groups. Nice part is that new binds both SL and Lion work wonderfully. However, any machines that were already bound don't work. I assume this is because even though the Kerberos realm has the same name, there has to be some differences in hash or whatever else Kerberos is using for encryption. There are log entries telling me about all the computers trying to connect that the server can't find in it's database.
Where to go from here?
Not sure. How do I find out what is broken in the Archive? I know that 10.7 took out the option of -merge in slapconfig which may or may not have worked here. Knowing what the "Connect to another directory" option in Server Admin is doing would help out greatly. Not knowing why that simple step does changes everything is deflating to say the least.
I should be talking to an Apple Engineer tomorrow. I will post back.
Nick.