I tested this without pam_ldap, and apparently the bug works there. Also, this comes to syslog with default settings: kdm: :0[8223]: Cannot write to greeter for display :0