In /etc/pam.d system-auth is a symlink to system-auth-ac so update that instead.

Author: erwbgy

manifests/config.pp

@@ -8,15 +8,19 @@
   File {
     owner => 'root',
     group => 'root',
-    links => 'follow',
   }
-  file { '/etc/pam.d/system-auth':
+  file { '/etc/pam.d/system-auth-ac':
     ensure  => present,
     mode    => '0444',
     content => template('pamldap/system-auth.erb'),
     require => Class['pamldap::install'],
     notify  => Class['pamldap::service'],
   }
+  file { '/etc/pam.d/system-auth':
+    ensure  => present,
+    target  => 'system-auth-ac',
+    require => File['/etc/pam.d/system-auth-ac'],
+  }
   file { '/etc/nsswitch.conf':
     ensure  => present,
     mode    => '0444',