LDAP connections

I am setting up a connection from an (unchangeable) LDAP server to a Mac client. We’re using a custom mapping of the Real Name and Record Name, over LDAPv3 and SSL. I am able to query the LDAP server with the dscl command. I am able to su as a user on the LDAP server. What I can’t do is login through the login window. No matter what it immediately shakes on an LDAP-provided username and pass.
If I go into the secret console at the login window I can login without any problems (just not into the full desktop). Any suggestions? Failing that, anyone know where it might log the failures and the reasons for the failure?

Thanks,
Peter