If the LDAP Provisioner is manually invoked via the UI (eg, by manually reprovisioning a CO Person), it may report success even if the underyling LDAP operation failed. (A telltale symptom is that the provisioning status has not updated after the page refresh.)

This appears to be partly because the plugin is not properly capturing the LDAP error under most circumstances, and then because it does not throw an Exception with that error.

Note that due to limitations in the protocol, there may be limited information provided on error, but it should still be better than "success".