Ldap – How LDAP authentication works

the problem is that that guide is wrong, or at least sub-optimal.

/etc/pam.d/common-auth should have:

auth sufficient pam_unix.so nullok_secure nodelay
auth sufficient pam_ldap.so use_first_pass
auth required pam_deny.so

that says that either pam_unix or pam_ldap are sufficient to login, and any login failing both of those is denied. it tries local unix login first - which is extremely useful if your LDAP server is down or unreachable and you still need to login as a local user.

it also uses 'use_first_pass' rather than 'try_first_pass'...they are very similar except that it won't prompt for a password again if the first is wrong.

see the man pages for pam_unix and pam_ldap for more details.

BTW, adding the following to /etc/pam.d/common-session is very useful:

session required pam_limits.so

it allows you to use /etc/security/limits.conf and access.conf etc to have very fine control over which users are allowed to login (e.g. i limit ssh logins on my servers to members of the admins group), and also set resource limits (memory, maxlogins, nice priority, etc) for their login.

To do what you're looking for in the easiest manner possible you really want a Windows Domain (as @Joel Coel says in his comment). You don't have to use Windows Server to host the Domain-- Samba has worked fine in that role for years now, and Samba can back-end authentication into LDAP.

Using a Windows Domain for this is preferable to any alternatives because you're leveraginga lot of client code Microsoft wrote and tested, rather than using code that re-invents the wheel. You can move to newer versions of Windows using a Domain, versus being tied to code (like pGina) that doesn't work in newer Windows versions.