On all the Linux distributions I've used in the last 15 years, NSS has never been responsible for authentication, though. It's only been responsible for resolution actions like getpw* and getgr* (i.e. uid/gid to name), whereas PAM has been responsible for authentication and auditing. You have to configure both to support LDAP, not just one.