To restrict user authentication to ONLY users who belong to a specific organizational unit, which file should be modified?

The `ldap.conf` file is the global client configuration file for LDAP applications and PAM modules, where parameters like `base` (search base DN) and `filter` can be set to restrict user lookups to a specific organizational unit, thereby controlling which users can authenticate.

`pam_ldap.conf` is an older or less common configuration file; modern PAM LDAP modules usually rely on settings in `ldap.conf` for such global restrictions.

`pam.conf` is the main PAM configuration file, but it typically delegates LDAP-specific parameters like search bases to the `ldap.conf` file or module-specific configurations.

`/etc/pam.d/login` configures PAM for the `login` service, but it specifies which PAM modules to use, not the specific LDAP parameters like base DN for filtering users.

`/etc/pam.d/ldap` (or a similar name) configures the PAM `ldap` module, but the detailed LDAP server and search parameters for restricting users by OU are usually sourced from the global `ldap.conf` file.