Can't create Local Network Users in Yosemite

Question

I can't create Local Network Users (or change passwords)
Logged on to /LDAPv3/127.0.0.1 as directory administrator
When I try to create a new user (press the [+], fill in the form), it brings up the message:
existing connection is not authenticated or secure: password change denied
I suspect this is emblematic of other issues. I can authenticate for Mail and SMB, but not for AFP or Xcode

Answer 1

So I had this problem last night as well when I upgraded my 10.9.5 OD master to 10.10.
Two obvious problems after that upgrade:
1)  Could not add a new Local Network User
2)  Existing users could not connect via AFP (but could via SMB)
Through a series of trial and error (and with two Apple Support people...), we found that the following actions seemed to help fix some (but not all) of the problems.:
Problem #2 seemed to initially be fixed by archiving the OD Master, destroying the OD Master and then reimporting from the archive.  I archived from the upgraded 10.10, but should probably have tried restoring my 10.9.5 archive (which may end up being why I still have some problems...)
Problem #1 seemed to be solved when I used WorkGroup Manager to reset the password on the Directory Administrator account I use  (I also blew out all references to that account from the Keychain, so everything reprompted me to add that password
However, we think the root cause of this might have been that in /var/db/openldap/migration, the following "dot" files were still present after the upgrade
fs:migration root# ls -la
total 6308816
drwx------  10 root  wheel         340 Oct 30 18:59 .
drwxr-xr-x   6 root  wheel         204 Oct 30 18:57 ..
-rw-------   1 root  wheel           0 Oct 30 18:59 .autossl
-rw-------   1 root  wheel           0 Oct 30 18:59 .enableODProxyd
-rw-------   1 root  wheel           0 Oct 30 18:59 .rekerberize
-rw-------   1 root  wheel           0 Oct 30 18:59 .updateLocales
-rw-r--r--   1 root  wheel      333436 Oct 30 18:57 authbackup.ldif
-rw-r--r--@  1 root  wheel      617453 Oct 30 18:57 backup.ldif
-rw-r--r--   1 root  wheel      617453 Oct 30 18:57 backup.ldif.backup
-rw-r--r--   1 root  wheel  3228537344 Oct 30 18:59 oldsystem.tar
Those 4 .dot files were *not* present in that directory on the two other test OD Master servers that I upgraded without issue.
So we removed them and after having done all the above as well -- I can now add users to the server.   The OD engineer I talked to thought that the presence of those .dot files may have been triggering something to rerun every time PasswordService launched.
When all was said and done, I was then able to "kinit <mydiradminaccount>" correctly and get a "klist" without issue.
ALL THAT SAID:  As of this morning, *some* (most?  I don't know yet) of my existing OD user accounts are able to successfully log into the server.   A couple of them (so far) are reporting that their account is "disabled" (which is different from the "shaking"/can't-log-in behavior) -- but they can still log in via SMB -- so I think there was still a problem migrating OD accounts in the upgrade process.
AND -- I noticed that -- in Server 4.0 -- "change password" is greyed out, so I have to use WorkGroup Manager to change server account passwords. 
Whee...