When I installed on a client machine, ipa-client-install couldn't find the ldap server via DNS, so it hard-coded the value in /etc/ldap.conf. I'm using two IPA replicas, so this is not good. I solved this by removing the installed version of nss_ldap and compiling the Fedora 10 nss_ldap source rpm, and now everything seems to work.