A combination of success=1 and pam_rootok.so should work:
auth [success=1,default=ignore] pam_rootok.so
auth optional MODULE
From man 5 pam.conf:
For the more complicated syntax valid control values have the
[value1=action1 value2=action2 ...]
Where valueN corresponds to the return code from the function
invoked in the ...
Using access.conf to prevent ssh, and only ssh, logins does not work. However, it can be accomplished by using pam_access with another config file.
Firstly, PAM must be configured to use pam_access. It might not be by default. There should be a line with account required pam_access.so in the sshd PAM config, likely via the password-auth configuration file,...
The way PAM works is that it follows every line until the end (or until it short-circuits with a particular failure). Each of those keywords says how the authentication step is treated.
What you want is to tell it that LDAP authentication is acceptable for authentication. So you need to put your pam_ldap.so line PRIOR to that final line. That says that ...
With sshd you need to explicitly configure it to use PAM
UsePAM Enables the Pluggable Authentication Module interface. If set to
yes this will enable PAM authentication using
ChallengeResponseAuthentication and PasswordAuthentication in
addition to PAM account and session module processing for all
At the end of your /etc/pam.d/common-session, there seems to be a (partial?) copy of /etc/nsswitch.conf:
# end of pam-auth-update config
passwd: compat systemd nis <--
group: compat systemd nis <-- These lines definitely
shadow: compat nis <-- don't belong here!
gshadow: files <--