You might look into using the mod_proxy module for ProFTPD. You could configure it to be a reverse FTP proxy, with users authenticated by the proxy, and with a different set of credentials used to login to your backend servers.
# Authenticate via LDAP
# Add your mod_ldap configuration here
ProxyReverseServers ftp://server1:firstname.lastname@example.org ftp://server2:email@example.com
# Tell mod_proxy to authenticate users locally (e.g. via mod_ldap)
We use ProFTPD's
mod_ldap for LDAP authentication, and tell
mod_proxy to authenticate users locally (versus having the selected backend server authenticate the user). Finally, notice that the backend server URLs for the
ProxyReverseServers directive use the URL syntax that contains a username/password. That syntax is used to configure/override the username/password that
mod_proxy uses when authenticating to the backend server.
This means that your users (the "frontend" clients) would authenticate normally, using their LDAP username/password, to
mod_proxy. The proxy, when connecting to your servers, uses the usernames/passwords that you don't necessarily want to share with your users.