Logins fail with the following nsswitch.conf
# An example file that could be copied over to /etc/nsswitch.conf; it
# does not use any naming service.
# "hosts:" and "services:" in this file are used only if the
# /etc/netconfig file has a "-" for nametoaddr_libs of "inet" transports.
passwd_compat: ldap vas4
hosts: files dns
passwd_compat only handles one entry, so in the example above only ldap auth would work. If vas4 was first that would work and not ldap
Set as so:
passwd: compat vas4