Can't log in to a OD client

Question

I've been having trouble setting up a replica so I figured I'd trying just connecting to the OD server as a client. I set up things in "Open Directory Access" and then
If I do a finger of myself I get the corrct response
Directory: /Network/Servers/Systemname.local/Users/pat
(said no such user before this)
But I still can't log into this system (or su to myself). If I try I get this in secure.log
com.apple.SecureServer: authinternal failed to authenticate user pat.
com.apple.SecureServer: Failed to authorize right system.login.tty by process /usr/sbin/ssh for authorization created by /usr/sbin/sshd
Anyone have any idea what my problem is?
Thanks.
Pat.

Answer 1

No reason to be angry as it's in his book on page 112. You possibly did not understand its significance until you'd done it yourself?
In an AD-OD integrated environment (I prefer this to 'Magic Triangle' as there is no triangle as such) there are no users in OD. They're all in AD. You nest AD Users or Groups (best to use groups) into an OD Group and apply managed preferences that way. You could bypass group nesting if you wish and simply create OD Computer Groups instead. Manage the workstations directly. All users admin or not, local or otherwise would have have those preferences applied.
"Are preferences correctly inherited between AD and OD groups and users?"
In my experience they are.
"What if I want users in some AD Groups to be controlled users on the client and users in other AD groups to be admins on the client?"
You can do the first part of the question using the provided Server Tools, PM or WGM. To make users local admins you use a terminal command. You don't want to be doing this for student accounts. To make AD groups administrators access Directory Utility's Advanced Options section in the AD plug-in. Clicking on the Administrative tab should give you the option you may be looking for? Alternatively you could use the command line (man dsconfigad) as there are more settings available using it than there are in the GUI.