Password - Ldap update

[ldap@mm.st]

We have RH5 servers with openldap-2.3.43 used to authenticate systems
via ldap and pam settings.  We are using  a single master and our
consumers run in refreshOnly mode.  The consumers are placed on various
networks so the systems do not need to traverse a bunch of routers to
contact the server for authentication.  The consumer is  the first
server listed in the ldap.conf files and the provider is listed as the
secondary for the systems.  We need to allow only certain users to
change their passwords via the passwd command and will be trying to
figure out an ACl to put in the servers slapd.conf files to accomplish
this.

The question is, if the system authenticates against a consumer which is
read only and their password has expired,  when they try to change their
password I assume that the command will fail since it can not write to
the consumer which is read only?   If this is the case and the provider
is listed as a secondary or the slapd.conf file for the consumer has the
provider listed as the updateref, will the system try the provider when
it can not write to the consumer? 

Unfortunately, I am unable to test this right now and wanted to get some
feedback on how this works.