How do y’all feel about FreeIPA? I deployed it a couple of times and I quite like it, but it’s not something you can whip up in an hour or two. The list of gotchas and “deployment considerations” all but guarantee you’ll have to reinstall the server at least a couple of times.