Please excuse the length - part of this post is brainstorming for my own benefit. and part of it is documenting what all I have tried.
Environment:
10.8/10.9 client machines
10.6.8 OD servers
OpenLDAP servers
JSS 9.32
Mobile accounts with no syncing (so just local storage)
The client machines are currently bound to the 10.6.8 servers. A previous admin was using createmobileaccount scripts to create mobile accounts, and I found this was causing problems where credentials were not being cached on the client machine. I know the documentation all says that the credentials should be cached on first good login when the server is available, but I could image machines with the createmobileaccount script, log into the mobile account while connected to the network, and then be unable to log into the account if I pulled the ethernet cable.
This was resolved when I went to a Configuration Profile pushed down to the client machines. Mobile accounts were being created correctly and the credentials were being cached properly.
We would like to retire the 10.6.8 servers, and would like to move to an existing OpenLDAP system. Binding the machines to OpenLDAP has worked. Kerberos seems to work - I am able to load a Kerberos-ed web site in Safari.
The issue is that, without any other work, users end up with an empty home folder (since NFSHomeDirectory gets mapped to #/Users/$uid$/ which is nonexistent on login. So user foo knows to use /Users/foo/ but that folder is created without any contents. I would have thought OS X would fill that folder using user template, but I was incorrect.
The solution would be to use the same Configuration Profile as with OD, telling the machine to automatically create mobile accounts when any network user logs in. This instantly puts up an "Unable to create mobile account" error at the login screen and drops back to the login screen.
The next solution was to create a LaunchAgent to run createmobileaccount on user login. This did not work for some reason - the user kept ending up with an empty home folder again.
The last solution I just tried was to give up and create the mobile account at imaging. I created a script that runs createmobileaccount -u $4 and runs at imaging reboot. This works, but we run into the very first problem - the credentials are not cached, and losing network connection means the mobile account can no longer log in.
I have been testing with a 10.9.4 test machine.