This is exactly what Kanidm does, and there is already some ideas around application password validation via the LDAP facade.