How are you handling authentications?
If I remember correctly, in the RADIUS config we were using, Locals passed requests up to Master to present to the RADIUS server. Not sure how well that failed over when Master was offline - I probably just had is misconfigured ;)