man nsswitch.confIt might just twink something for you that turns the light on for it.
Not to sure exactly how you have everything setup.
The Relevant part is:
\n`[' ( `!'? STATUS `=' ACTION )+ `]'\n\nwhere\n\nSTATUS => success | notfound | unavail | tryagain\nACTION => return | continue
I always try to stay away from Pam. If I do mess with pam, nearly always I use something designed to fuss with it. Lastime I used Webmin to manage the settings, which worked very well. That Might be extreme though in your case.