AIX

Curiosity killed the cat - so I am asking what did you change, what did you set back.

If you want to use RBAC and pconsole you might be able to setup some RBAC for a user.

In any case, you need to let pconsole (if you were planning on using that) create the role for a user (normally pcon_username) for roles needed while using pconsole (or pcons_username - I forget).

The SYSTEM parameter in /etc/security/user should make sure that LDAP is used for login, so username/password is stored in LDAP - while having an additional definition of the USER (will need to run mkuser -R files id=NNN pgid=GGG) to create the user in the local registery.

lsuser username will tell you how AIX sees the user after login.
lsuser -R files username (AIX view local files only)
lsuser -R LDAP username (AIX view using LDAP information only - I think. If it is giving information that is not in AD then it is still going to the files are to fill in blanks (in particular the default: stanzas in /etc/security/*).

I've just removed all my custom authorizations (rmsecattr, rmauth) and then updated the kernel tables (setkst).