nss_ldap:
use_sasl no
rootuse_sasl yes

also nss_ldap:
krb5_rootusekeytab 1
krb5_rootautorenew 1

How many conflicting conventions can we use in a single file?

(FYI, the '1' values above are parsed via atoi() in source).

Also nss_ldap.. tls works in some execution environments and not others, still tracking down the root cause of THAT (same .so file, same host, same config file. ktrace indicates that it isn't even LOOKING at the cert store in some cases)