[Samba] using samba4 as an authentication source

[Admin]

Hi,
i have to deploy a integrated services platform consisting of a samba3, 
web-groupware and email (exim+cyrus) service, which has very limited 
options for user management. This new server is  to replace a windows 
2008 server. I am free to create all users anew.
I'll try to configure it to use an external source as a single source of 
authentication and join the samba3 to a samba4-Domain but i'm unsure 
about the mail and webservices: should i/can i use samba4's build in 
ldap server? Or would it be better to use the kerberos service? Or winbind?
I would appreciate any advice for the most standard conformant way to 
get things working.

Thanks a lot
Malte