Ok, first things first.

a) for ease - become root/su and verify with id

Code:

michael@x071:[/home/michael]id
uid=0(root) gid=0(system) groups=0(system),2(bin),3(sys),7(security),8(cron),10(audit),11(lp),13(dbsysadm),207(idsldap)

b) make sure root is local, i.e., not LDAP administered (system and registry settings)

Code:

michael@x071:[/home/michael]grep -p root: /etc/security/user
root:
        admin = true
        SYSTEM = "compat"
        registry = files
        account_locked = false
        dictionlist = /etc/security/aixpert/dictionary/English
        login = false
        rlogin = false
        loginretries = 0

c) check your current defaults for SYSTEM and registry

Code:

michael@x071:[/home/michael]rity/user | egrep "SYSTEM|registry"                <
*               Possible values: SYSTEM,NONE,token;username.
*                       SYSTEM  : Describes normal password authentication in
*                                 an authentication grammar.  See SYSTEM 
*                               auth1 = SYSTEM,mylogin;mary
* SYSTEM        Describes Version 4 authentication requirements.  This 
*               SYSTEM grammar manual pages. 
*                       SYSTEM = "DCE OR DCE[UNAVAIL] AND compat" 
* registry      Describes where this user is administered.  It is used
        auth1 = SYSTEM
        SYSTEM = "compat"

d) notice in the comments the example for SYSTEM way back when (1995ish) when DCE was more popular. I will rephrase this:

Code:

if (DCE authentication succeeds)
 then authentication successful;
if (DCE not available AND compat authentication succeeds)
 then authentication successful;

In other words, "compat" is only used when DCE is unavailable. Yours should substitute DCE with LDAP.

e) From memory (i.e., without additional testing) I cannot say exactly what registry = LDAP is doing. But I expect, not what you expect. Maybe if you have added the AIX schema into your CentOS LDAP server it might work. But since mkuser/chuser/etc -R LDAP is not working I expect the LDAP server is refusing because it does not have the AIX (LDIF) schema for all the attributes in /etc/security/user (to name just one of the registry 'files').
I suggest returning "registry = files" as the default setting.

Code:

chsec -f /etc/security/user -s default -a registry=files'

f) For users, rather account names, that must be local add at least "SYSTEM=compat" to the user, e.g., for michael

Code:

michael@x071:[/home/michael]chuser SYSTEM=compat michael
michael@x071:[/home/michael]grep -p michael: /etc/security/user | egrep "SYSTEM>
        SYSTEM = "compat"

Other stuff) - back from 2000 when I designed the AIX security curriculum.
The key two attributes for Identification (aka username) and Authentication (aka password verification) are auth1 and SYSTEM. This is easy to delegate to an external I&A service, e.g., LDAP, DCE or kerberos server.
The third /etc/security/user attribute is registry - and, with no access to program code, design documents, etc. to verify it I have always understood this to be where to look for additional information about a user that is not uid/gid to username/groupname lookup (and v.v.). In a literal sense I take this to mean - when registry=LDAP (as is your case) to not even look in /etc/passwd for my HOME directory or default shell (for the RFC2307 attributes that any UNIX oriented LDAP server should have).
You might be able to test this by changing the home directory of a user using both -R files and -R LDAP. If you do, please post results and expand my understanding!