I hadn’t tried logging in graphically with a user still in /etc/passwd for a while. When I did try, I had to enter the password twice. So, I needed to figure out what in /etc/pam.d/gdm was wrong. I made the file look like this and everything works as expected:
#%PAM-1.0 auth required pam_env.so auth sufficient pam_ldap.so auth sufficient pam_unix.so shadow nullok use_first_pass auth required pam_stack.so service=system-auth auth required pam_nologin.so account required pam_stack.so service=system-auth account sufficient pam_ldap.so password required pam_stack.so service=system-auth session required pam_stack.so service=system-auth session optional pam_console.so