https://bugs.openldap.org/show_bug.cgi?id=9863
--- Comment #5 from Quanah Gibson-Mount quanah@openldap.org --- (In reply to Michael Ströder from comment #3)
This sounds somewhat related to my question on openldap-technical about slapo-syncprov on read-only consumers:
https://lists.openldap.org/hyperkitty/list/openldap-technical@openldap.org/ message/QDHF7YR3QM7OUG5SGWGZDA3NL2TL3X3D/
Yes, similar issue except that I have forwarding configured. Generally I would say that for ppolicy and lastbind, forwarding should always be enabled (and functional, which it currently is not for lastbind). Even if syncprov is not enabled on the consumers.