Error message "You need the manage sprint permission for all projects in the origin board to manage this sprint"

[Sandy]

User has been given project admin role across all projects where stories originate. Still no luck in him being able to close a sprint.

[JobTarget Operations]

Since you set the Directory Type to MS Active Directory "read-only", it will not allow AD-authenticated users to change their password inside of JIRA.  If you change the type to MS Active Directory to "read/write", then they can change their password inside of JIRA.  You'll have to log in as a local JIRA admin (not AD-authenticated) to change the directory type.  For your external clients, you can have them use the local JIRA directory for authentication and they can do password resets and changes without AD accounts.  You do not need SSL between JIRA and your DC.  I would however recommend setting up SSL on your JIRA instance since it is public-facing.  Here's how to do that - https://confluence.atlassian.com/display/JIRA/Running+JIRA+over+SSL+or+HTTPS

Good luck!

-Kyle