With release 0.7.7 of nss-pam-ldapd there is a new mechanism available for a process to disable lookups using the nss_ldap module. The nslcd daemon uses this to avoid name lookup loops (e.g. when doing a host name lookup for an LDAP server which may result in an nslcd request, etc).

The code to do this is in disable_nss_ldap() in nslcd/nslcd.c.

This may be of interest for the nssov module. The chance of something like that happening is probably lower in nssov (because most information is looked up internally) but it is probably a good idea to avoid such loops anyway.