Prevent pam_ldap authentication for existing local users

Hello, using Solaris 11.3 with mixed local / LDAP authentication.

What we want is following:

- If local user exists, authenticate only that and never query pam_ldap

- If local user does not exist, query pam_ldap

This is the "recommended" config..

auth binding         pam_unix_auth.so.1 server_policy debug

auth required           pam_ldap.so.1 debug

When local user exists, it seems there is no way to force only checking local password. Both the local and LDAP password (which are different) work and allow login as the local user.

No matter what combinations I try, either login doesn't work at all or both password work.