Setting up OS X 10.6 Server as a BDC for Windows Server 2003

Question

Having some issues setting up an OS X server to act as a backup domain controller for Windows 2003 Server R2. I'm following the Apple document OpenDirectory_Adminv10.6.pdf.
On page 90, it says I have to first setup the OS X server as an Open Directory Replica. So I turn to page 87 and follow the instructions. It says SSH has to be available on both the OS X server and master OD, this being the Windows server. So I install openSSH on the Windows 2003 server, create the local group file and passwd file. I verify I can ssh into the Windows server from the OS X server as the Windows administrator account.
From a fresh OS X server install (all updates installed and DNS configured to point to the Windows server that is running DNS server service), I follow the steps on page 88 and get stuck at step 9. The configuration logs on OS X says "Removing replica because the replication credentials or suffix could not be determined. (error = 69)".
On the Windows 2003 server, I had to create an account called root. I gave it all the privileges that Administrator has. I couldn't even get past step 8 until I made this account.
Things I've tried:
Joining the OS X server to Active Directory as a member computer first. (fails both ways, joined and not joined first)
Adding the computer account for the OS X server to the Domain Controllers group in Windows
Not creating a computer account at all and not joining AD first.
I'm not sure what to do from here. Not sure if it's an ssh issue as Windows doesn't have a native ssh server service. I can ssh from a terminal window on OS X so I know ssh is working to some extent. Just not sure if it can get to wherever the replication scripts need to access.
Both the OS X server and Windows 2003 server are on the same sub-net without any firewalls.

Answer 1

Hi
AFAIK the "Magic Triangle" applies to an environment that also includes OSX Server providing mac-style GPOs - mostly. There's another option called "Cylinder of Destiny" that takes this slightly further although it's still essentially the same. Ultimately what you decide rests on what you want to achieve.
If all you want is SSO for Users working on mac workstations and nothing else, use what Apple provides in the Client OS. You don't necessarily need OSX Server.
It's even possible to alter the AD Schema itself and add Apple specific object classes, attributes and values to provide a means for managing users on mac workstations that way. Again you don't necessarily need OSX Server. In addition there are 3rd-Party solutions that don't involve OSX Server you could consider depending on budget and how hard you want to work? Likewise, Centrify and AdmitMAC are three I can think of.
There's plenty of documentation all over the internet on how to achieve Integration. Its been going on for a few years now. Ultimately how 'successful' it all is will rest primarily on how well your AD is configured. Apple's built-in Active Directory Plug-in in many ways assumes an 'out-of-the-box' AD and ideally an environment that follows Microsoft's Best Practices for AD. I've yet to see one AD that fits that criteria. In some rare cases Integration may not even be possible. You won't really know until you try.
Tony