If you're going to start mixing local and LDAP stuff that way,
you're
going to run into some fun-to-debug strangeness if you're not careful
about them all being identical.
Thanks again for your help, I have this working now. I had a comma in
my AllowGroups line instead of a space.
We're slowly extricating ourselves from the local authentication, but
this is quite a non-standard environment. Once we have ldap running
rock-solid smooth we're planning to go back through and remove all
local users from /etc/passwd and /etc/shadow.