password    sufficient    pam_unix.so nullok md5 shadow
{
    my $status = $ldap{Authentication} || 'disabled';
    return unless $status eq 'enabled';
    $OUT .= "password    sufficient    pam_ldap.so";
}
password    required      pam_deny.so