I agree with OP that the user authentication data should be segregated, simple, and very well protected. It should act like a hardware security module: it will

I agree with OP that the user authentication data should be segregated, simple, and very well protected. It should act like a hardware security module: it will authenticate users, but never give up their keys. I tried to find decent hashing in OpenLDAP and Apache DS but didn't. Perhaps I didn't look hard enough. Do they throttle by default? Who's gonna make LDAP webscale and hipster friendly?