JIRA currently does this - if you've enabled LDAP support, authentication doesn't fall back on local auth. In Confluence, if you get the LDAP password wrong, you can still fall back on attempting to match the password in the local DB.

Apparently JIRA are using a hacked OSUser provider - if we adopt the same hack, we're fine.