Cannot login with ldap+pam+nss

I want to use AD user to login my rhel6 workstation.
I had created a openldap proxy to forward the authentication. And ldapsearch works well:
ldapsearch -x -LLL -h openldap.domain.com -D "cn=open1,cn=users,dc=domain,dc=com" -w password

But I cannot login with UI. I had tried sssd as well as pam+nss for 3days. But still fail.
Is there a doc for me to follow?