With the PAM framework, you can choose among several authentication services, including the pam_unix_*, pam_krb5, and pam_ldap_* modules.
To use per-user authentication, you must enable pam_krb5. However, you can still use pam_krb5 authentication even if you do not assign the per-user credential level. If proxy or anonymous credential levels are used to access directory server data, then you cannot restrict access to directory data on a per-user basis.
If you choose anonymous or proxy authentication, use the pam_ldap module instead of the equivalent pam_unix_* modules. The pam_ldap module is more flexible, supports stronger authentication methods, and can perform account management.