5.1 beta2 still in trouble with pam_ldap

Hi

I've installed 5.1 beta2 but I'm still in trouble
with pam_ldap / nss_ldap 

the scenario is the following

if in any file of the pam.d directory I replace
the original line :

auth           required        pam_unix.so             no_warn try_first_pass nullok

by the following 

auth            sufficient      /usr/local/lib/pam_ldap.so

for example in the /etc/pam.d/su file I can perform the "su -"
command WITHOUT TYPING ANY PASSWORD from a normal user login.

Do I missunderstand pam concepts or is it a real bug ?

LDAP related packages installed are 

openldap-2.0.25_3
nss_ldap-1.204_1
pam_ldap-1.6.1

Thanks for any infos
-- 
Frank Bonnet