[CentOS] Help integrating CentOS 6 with existing network login infrastructure

I've updated my kickstart configuration files to work with CentOS 6 and am most of the way there integrating a CentOS 6 system into our LDAP/NIS environment.  My authconfig line in the kickstart file is as follows:

  authconfig --enablemd5 --passalgo=sha512 --enablenis --nisdomain=XXX --nisserver=nis.XXX.com --useshadow --enablekrb5 --krb5realm=XXX.COM --krb5kdc=ldap.XXX.com --krb5adminserver=ldap.XXX.com

This is virtually identical to the authconfig line I was using in CentOS 5.  My issue is that users cannot log in with their network (NIS) usernames and passwords.

If I log in as root, I can do a "su - username" and get the user's automounted home directory with the correct uid/gid, but if I try to log in as the user, or do a "su - username" as a non-root user and have to enter the password, authentication always fails.

The entries in /var/log/secure just say "su: pam_unix(su-l:auth): authentication failure".  I'm not a pam expert and don't know how to debug this.  Anyone else run into this and/or know what might be the problem? This works just fine in CentOS 5.

Alfred