It has been discovered that libpam-ldap, the Pluggable Authentication Module allowing LDAP interfaces, ignores the result of an attempt to authenticate against an LDAP server that does not set an optional data field.
a74992637e7caddaf288f4816c0a816ce56ad09221e09eaa931c5a8815a9e774