checkpassword vs Solaris 10

Hi,

I have upgraded my qmail server onto a newer solaris 10 box,
and almost everything works.

What I have discovered is that checkpassword does not authenticate
users who are not local to the machine, which used to work fine in
Solaris 9.

Our userdb is openldap,  and the password&shadow files have
+:x:::::
and 
+::::::::
respectively.

nsswitch.conf is set up to find users this way:
passwd: compat
passwd_compat: ldap 
shadow: compat
shadow_compat: ldap

so that getent passwd <user>  works fine.

Is there a subtle difference between Solaris 9 and Solaris 10 that
I didn't realize?  I haven't seen any references to issues online,
so I thought I would ask around here as well.

thank you,
Jim Craig