I'd rather spend a day debugging puppet talking to ldap (which is not very robust, I must admit) than debugging pam/ldap when it's not working