The plan of action at the high level is:
User puts in log in details
if ldap accepts these
log in
elseif local database excepts these
log in
else
fail
What I'm guessing is that I need to override the authenticate_user! method but it didn't seem obvious what I'd need to include to make sure that the LDAP users could still log in.