Activating PAM configuration for Percona

I'm trying to configure Percona with LDAP support via PAM including group mappings and restriction. My Percona authentication setup is as follows:

INSTALL PLUGIN pam SONAME 'auth_pam.so';

create user 'dba'@'%' IDENTIFIED WITH auth_pam AS 'mysql';
grant all privileges on *.* to 'dba'@'%' with grant option;

create user 'dbr'@'%' IDENTIFIED WITH auth_pam AS 'mysql';
grant select on *.* to 'dbr'@'%';

CREATE USER ''@'' IDENTIFIED WITH auth_pam AS 'mysql, sudo=dba, mysql=dbr';
GRANT PROXY ON 'dba'@'%' TO ''@'';
GRANT PROXY ON 'dbr'@'%' TO ''@'';

And in /etc/pam.d/mysql I have:

auth required pam_warn.so
auth required pam_ldap.so
account required pam_ldap.so
account required pam_succeed_if.so user ingroup mysql

With these in place, the following works:

• Log in as an LDAP user in sudo (and mysql), gain privileges of dba.
• Log in as an LDAP user in mysql, gain privileges of dbr.
• Attempt login with invalid username and/or password, get no access.

And the following behaviors are incorrect (should be refused login entirely):

• Log in as an LDAP user in sudo (but not mysql), still gain privileges of dba.
• Log in as an LDAP user in neither group, gain access with no privileges.

It took quite a while to eventually figure out that the configuration in /etc/pam.d/mysql is having no effect. The behavior is the same even when that file is not present.

My understanding is that the first value in the string mysql, sudo=dba, mysql=dbr tells Percona to use the PAM configuration in a file named mysql, and all tutorials show the filename resolving to /etc/pam.d/mysql.

What am I missing?