If you want to be able to map the simple username "myUser"
to say, "uid=myUser,cn=Users,dc=mycompany,dc=net", you
probably are best off using SSSD to handle that.
SSSD can be configured to know where to search and how to
apply the supplied username to the search (i.e. to look for
anything under cn=Users,dc=mycompany,dc=net where uid=[the
supplied username]).
SSSD in turn provides a PAM module to talk to the SSSD
daemon itself, which is where you can hook up your PAM
passthrough authentication.
i.e., we use SSSD for SSO login to our Linux machines, and
have the following lines (in addition to the usual stuff) in
our pam.d/password-auth :
auth sufficient pam_sss.so use_first_pass
account [default=bad success=ok user_unknown=ignore]
pam_sss.so
password sufficient pam_sss.so use_authtok
session optional pam_sss.so
