Comment 12 for bug 334374

I think Thierry's solution in comment #10 is the way to go. It's appropriate for ldap-auth-client to depend on libpam-ldap, because that's the intent of the metapackage. But ldap-auth-config provides /etc/ldap.conf, which you need whether or not you're using LDAP for authentication. (That package would be better named "ldap-config".)

I see that libnss-ldap now recommends ldap-auth-config instead of hard-depending on it. But this is not useful, because without /etc/ldap.conf, you have no working LDAP setup. (Robie Basak made this change recently; I've subscribed him to this bug.) I think that this particular hard dependency was correct, in fact---unless you manually create a new /etc/ldap.conf from scratch, I see no reason why you would want to install libnss-ldap without ldap-auth-config (dependencies of the latter aside).

[tl;dr] IMO, the solution is
* ldap-auth-config Recommends ldap-auth-client
* libnss-ldap Depends-on ldap-auth-config