In the BSD world we have another user attribute known as a login class. The login class lets us apply limits to users via /etc/limits.conf or on FreeBSD also via the new Resource Accounting (rctl). Unfortunately all users in LDAP via nss-pam-ldapd/nslcd get the "default" login class. I have added the userClass attribute to user objects in Active Directory and wish to make this mapped to the user login class on my servers. This is something that OpenBSD's ypldap daemon can do (https://man.openbsd.org/ypldap.conf.5#class) and inspired me to look for this feature in nss-pam-ldapd.

I am currently looking into the code to see how I can make this possible, but I am a complete novice in this area.