To restrict user authentication to ONLY users who belong to a specific organizational unit, which file should be modified?

The `ldap.conf` file (or `ldap.conf` in `/etc/openldap/`) is the global client configuration file for LDAP applications, including those using PAM-LDAP. To restrict user authentication to a specific organizational unit, the `BASE` or `BIND_DN` parameters within `ldap.conf` can be configured with a specific Distinguished Name (DN) that points directly to the desired OU, thus limiting the search scope for users.

`pam_ldap.conf` is for PAM-LDAP module configuration, but often points to or leverages settings in `ldap.conf` for general client-side LDAP parameters like base DN.

`pam.conf` is the main PAM configuration file (though often replaced by `/etc/pam.d/` directory structure), but it defines which PAM modules are used, not the specific LDAP search parameters like base DN for filtering OUs.

`/etc/pam.d/login` configures PAM for the `login` service specifically, defining which PAM modules are called, but it does not configure the LDAP search base for user lookups.

`/etc/pam.d/ldap` (if it exists) would configure PAM for an `ldap` service, but it typically defines module usage rather than LDAP client parameters like search base.