I think thak a Radius Authentication Plugin could be usefull.
A freeradius server is simple to setup (more simple than the frustrating openldap) and radius protocol could be used to implement a single authentication point for VPN access, system access and to implement two factor authentications.
Regards