I think LDAP is the right way for us. We do not want to conenct to customers own authentication services, we are planning to use our own authentication service for vCloud Director, and to be more precise for TrendMicro Deep Security + EMC Avamar.
All of them offer LDAP support, we just have to figure out if they supprt AD LDS. vCloud Director seems to be the most flexible solution. The only concern that remains is that we have to provide the users a possibility to change their passwords. I have not tested it, but i doubt that changing a ldap user password from vCloud Director is possible ;-)
I am able to extend the API of vCloud Director to update the user credentials, but that still requires some webbased user interface. And that is something we can't do. At least not in a way that it looks nice :-(