VPP issues with managed Apple IDs

Are they signed into iTunes and App Store using the MAID? We had this issue for students and it turns out they were signed in there using standard Apple IDs so they could download personal content. Signing them in with the MAID and re-launching iBooks I think prompts you to sync with the MAID, and once that is done it should go through eventually.

In the end I was able to send those students a VPP invite via email. Was able to accept that invitation and assign the book to them.

Can you explain how you did this? I can find no accurate documentation explaining VPP user assignment, and even after cobbling together various parts of the manual it still doesn't work. We get as far as the user account has been made (User user (user tab) not JAMF user (system settings), since those seem to be separate concepts that are not clear...) and the email invitation got sent. When you click the link in the email, it takes you to a really weird generic login page on the JSS. However, User accounts have no password, so how you would authenticate to this makes no sense. Trying to auth using the AppleID credentials does not work. Documentation seems to indicate the auth should be an internal one, but again with no password on these accounts that's impossible. Indication is after that auth, there is a button that takes you to Apple to auth to the linked AppleID, but we can't get that far.

Any idea what we're missing? The only other thing we can't figure out is the difference and purpose between the fields on the General tab and the Roster tab for the user account. Roster seems to be related to ASM imported accounts so we were ignoring that. All we're trying to do is add a user, send them the VPP invite, and assign them apps. This is easy in Profile Manager, but horribly complex in JAMF and doesn't seem to work because of this missing password issue...