auth      sufficient  pam_unix.so
auth      sufficient  pam_ldap.so use_first_pass
auth      required    pam_deny.so

account   required    pam_unix.so
account   sufficient  pam_ldap.so 
account   required    pam_permit.so

session   required    pam_unix.so
session   optional    pam_ldap.so

password  sufficient  pam_unix.so nullok md5 shadow use_authtok
password  sufficient  pam_ldap.so try_first_pass
password  required    pam_deny.so