I agree with OP that the user authentication data should be segregated, simple, and very well protected. It should act like a hardware security module: it will authenticate users, but never give up their keys.

I tried to find decent hashing in OpenLDAP and Apache DS but didn't. Perhaps I didn't look hard enough. Do they throttle by default?

Who's gonna make LDAP webscale and hipster friendly?