Description of problem:

One of new added functionalities of PAM PTA is support for multiple configuration entries. To be backward compatible, top-level configuration entry cn=PAM Pass Through Auth,cn=plugins,cn=config is still valid configuration entry. In addition to that, each child is also expected to be PAM PTA config entry. However, top-level config entry is being ignored when a child entry is present, and only child entries configure plugins behavior.

Version-Release number of selected component (if applicable):
tested on 389-ds-base-1.2.11.15-2.el6.x86_64

How reproducible:
always

Steps to Reproduce:
One way to reproduce is to setup top-level config entry to include ldap user and set child config entry to exclude user. Both instances have fallback set to false. When user tries to bind, top-level entry is ignored, and user binds. If however child config entry is set to include user entry, then user bind fails on 32 - user does no exist in PAM.

USERD="uid=tuserD, ..."

1) Add user $USERD
ldapmodify -h $IP -p $PORT -D "cn=directory manager" -w Secret123 <<EOF
dn: $USERD
changetype: add
...
userPassword: password
EOF

2) configure top-level entry to include $USERD and deny fallback
ldapmodify -h $IP -p $PORT -D "cn=directory manager" -w Secret123 <<EOF
dn: cn=PAM Pass Through Auth,cn=plugins,cn=config
changetype: modify
replace: nsslapd-pluginEnabled
nsslapd-pluginEnabled: on
-
replace: pamFallback
pamFallback: FALSE
-
replace: pamIncludeSuffix
pamIncludeSuffix: $USERD
EOF

3) configure child entry to exclude $USERD and deny fallback
ldapmodify -h $IP -p $PORT -D "cn=directory manager" -w Secret123 <<EOF
dn: cn=inst2,cn=PAM Pass Through Auth,cn=plugins,cn=config
changetype: add
cn: test1
objectClass: pamConfig
objectClass: top
pamIDMapMethod: RDN DN ENTRY
pamFallback: FALSE
pamSecure: FALSE
pamService: ldapserver
pamExcludeSuffix: $USERD
pamMissingSuffix: ALLOW
pamIDAttr: uid
EOF

4) restart server
service dirsrv restart

5) try to bind as $USERD
ldapsearch -h $IP -p $PORT -D "$USERD" -w password -b "$USERD"

Actual results:
echo $?
0

Expected results:
ldap_bind: No such object (32)

    additional info: User id [tuserD] for bind DN [uid=tuserD,dc=suf1,dc=example,dc=com] does not exist in PAM

Additional info:
​https://fedorahosted.org/389/attachment/ticket/181/0001-ticket-181-Allow-PAM-passthru-plug-in-to-have-multip.patch: "When the normal area in cn=config is used, both the top-level PAM passthru plug-in config entry and it's children are considered to be config entries."