The keystone folks have decided to deprecate project membership via ldap. This wasn't supposed to happen until M but in truth the v3 api is totally broken for this so we probably need to move sooner.
How, then, will pam/ssh determine project membership? I don't know.
the transition is described here:
https://openstack.nimeyo.com/29408/openstack-keystone-deprecation-assignment-project-assignment
And a tentative roadmap is here:
https://wikitech.wikimedia.org/wiki/Labs_keystone_roles#Steps