...
Additionally, the posixAccount and voPosixAccount objectclasses both required require a primary group to be set. Therefore, the presence of a Unix Cluster Account record in LDAP should not be sufficient in and of itself to permit login. One of the following should also be checked at login, depending on local deployment capabilities and need:
...