"They" say: Do all this stuff on the server, don't trust the client. That said (i had to say it, because everybody does and it is true to a degree), here's how i'm doing it in the "nameless Bomberman clone". That doesn't mean that its the best or even a clever way to do it, but it is, what i came up with after trying some things.
Each client manages its own entities. These are the entities that have been created by that client by the local player shooting, placing a bomb or a local bomb exploding. Except for the explosion, which i treat differently (but that shoudn't matter here), each client transfers its entities to the server in each iteration. The server is sending them back to all other clients in return (after doing a sanity check in some cases). An entity contains position, orientation, animation information, movement speed,... in a quite lean way, so the overhead of transfering them every time is negligible.
Between the iterations, the clients are interpolating the movement based on the last server data to provide smooth transitions. All entities have a unique ID combination consisting of clientID and objectID. If the server doesn't transfer an entity in an iteration, the clients will remove it from their list. With this, the server doesn't have to make the client explicitly remove objects.
Collision detection between local and remote objects is done on the client that has created the local one. The server does a (quite dump) sanity check to see, if this is actually possible.