libpam_ldap and openldap 2

[Richard A Nelson <cowboy@vnet.ibm.com>]

I've got libnss_ldap working well enough (it seems - It recognizes ldap
users as valid).

these files are pretty much identical (except for the commented stuff)
/etc/libnss-ldap.conf
/etc/pam_ldap.conf

I can't get pam_ldap working, though - it gives me:
$ su - guest
su: Authentication service cannot retrieve authentication info.
(Ignored)

/etc/pam.d/su has:
auth       sufficient pam_unix.so nullok
auth       required   pam_ldap.so use_first_pass

changing the order of the two auth lines doesn't help either...

I'm thinking it might be a SASL problem... the LDAP server *is* local
and I have this in both /etc/ldap/ldap.conf and /etc/ldap/slapd.conf
SASL_SECPROPS none

but that is the *only* SASL option I've set
-- 
Rick Nelson
Life'll kill ya                         -- Warren Zevon
Then you'll be dead                     -- Life'll kill ya