This is downright thorny, but I'm slowly getting somewhere.
CS has made adjustments to the dev ldap setup so that we can get the info we need without excessive modification to our build (that is, we can make anonymous requests for info from the ldap server).
All the interesting stuff gets done after installing some packages. It looks like there's a meta-package called ldap-auth-config that should install all the necessary stuff - primarily the pam stack.
Once installed, the config is done in /etc, and mostly in /etc/pam.d/

I'm making headway, but very slowly - documentation is non-existent.