Thanks for the help.
Unfortunately, I must have missed something: the password that I set with "setattr userpassword=<>" is not accepted.
I set up another VM, configured it using the ipa-client-install script, and I can do "su <username>" on the client, but both a ssh login of a "passwd" command fails on the password.
Should I have configured my ipa server to also be a NIS server for the transition? I see that the server has a yp.conf files that appear to have been configured when I configured the ipa server and client.