Can't figure out how to make my OSX Server / AD (magic triangle) work- Please help

Question

Hi there,
I have set up a machine with Mac OS X 10.9.1 and Server.app 3.0.2. I think installation and configuration was made ok (I do have experience with Macs and I am part-time admin for the Active Directory in my organisation). I set up a magic triangle by binding my Mac server to an Active Directory domain. Now, I am not a specialist for this so I bought and used "OS X Mountain Lion Server For Dummies" by John Rizzo, which helped me. I did set up everything, even including AD users to OD groups on the Mac server.
Now, I'm biding a Mac client to my OD server, and trying to log in. Can't do that. Any username I type that is not a local client name does not work. I have tried to use 'username' as a login and also 'DOMAINNAME\username', none of which work. I also tried to create a local network user on my OD server, and even with that username I can't log in on the client.
I did check System preferences / Users and groups :
- There is a green light next to my OD server name
- I checked the "allow network users to log in" and checked that "All users" are ok for login.
Two things that don't seem normal but I can't understand :
- Kerberos seems off on the server (klist in terminal returns nothing and Ticket Viewer.app shows no ticket)
- If I try to specify network users that CAN log in (i.e. not "everyone") I see users in the editor window but can't add them to the list
I'm kinda lost here. Anyone wishing to help?

Answer 1

No reason to be angry as it's in his book on page 112. You possibly did not understand its significance until you'd done it yourself?
In an AD-OD integrated environment (I prefer this to 'Magic Triangle' as there is no triangle as such) there are no users in OD. They're all in AD. You nest AD Users or Groups (best to use groups) into an OD Group and apply managed preferences that way. You could bypass group nesting if you wish and simply create OD Computer Groups instead. Manage the workstations directly. All users admin or not, local or otherwise would have have those preferences applied.
"Are preferences correctly inherited between AD and OD groups and users?"
In my experience they are.
"What if I want users in some AD Groups to be controlled users on the client and users in other AD groups to be admins on the client?"
You can do the first part of the question using the provided Server Tools, PM or WGM. To make users local admins you use a terminal command. You don't want to be doing this for student accounts. To make AD groups administrators access Directory Utility's Advanced Options section in the AD plug-in. Clicking on the Administrative tab should give you the option you may be looking for? Alternatively you could use the command line (man dsconfigad) as there are more settings available using it than there are in the GUI.