No, it's not possible to do this with only PAM.
PAM is a library for authentication, authorization, and related accounting tasks. It's not a low level library; if a program does not include explicit calls to PAM, it sits around doing nothing.
Lookups of uid and gid are routed through a system called NSS
(Name Service Switch). This is configured via /etc/nsswitch.conf
. If you are not providing a library for NSS to talk to LDAP, the low level C libraries can't perform lookups against it.
It is possible to use a different NSS library for LDAP that doesn't rely on nslcd
(this is how the old LDAP library supplied by PADL operated), but it's almost certainly a bad idea. Without a daemon running in the background, every call to NSS must open up a new connection to the LDAP server and immediately release it. This is extremely wasteful and makes it impossible for the libraries to track the state of the remote server, i.e. every NSS lookup must individually time out during a network outage.