I have an openldap master/slave configuration, setup as per the Ubuntu guide, on Ubuntu 12.04, running slapd 2.4.28-1.1ubuntu4.2. I have pam_ldap configured for ssh authentication, everything works fine as long as the master is up.
If I configure /etc/ldap.conf to point at only the slave, and the master is up, authentication works fine. But as soon as I take the master down, authentication fails and I can't login.
I can run an ldap search for my uid against both servers successfully, data returned is identical... the slave still shows data properly when the master is down.
The contextCSN is identical on both master and slave, and I've confirmed replication is occurring properly by changing an attribute on the master, roughly 30 seconds later the contextCSN is updated on the slave and a search for the attribute shows it updated.
The contents of /etc/ldap.conf with only the slave specified:
base dc=mydomain
ldap_version 3
pam_password md5
uri ldap://slave01
There's nothing in auth.log, syslog or the slapd.log that shows anything as to why this is the case.
Any ideas?