Comment 2 for bug 334374

> This way you can still remove libpam-ldap (afterwards)
> without libnss-ldap being removed too.

no (try it)

the problem is ldap-auth-client

libnss-ldap depends on ldap-auth-config
ldap-auth-config depends on ldap-auth-client
ldap-auth-client depends on both libnss-ldap and libpam-ldap

> Do you still consider this a bug?

perhaps it's not strictly a bug, but with the pam auto configuration introduced in 8.10 it leads to unneccessary confusion; you have to call pam-auth-update to explicitly deactivate libpam-ldap