I have worked in quite a few enterprise environments of which we have had freeipa as our centralized auth system for linux boxes. It can be integrated into active directory, or be stand alone, it can have replicatants in other datacenters, or regions, it has a pretty sleek UI, and does user SSH Key management, integrated DHCP/DNS, and can function as an internal CA using dogtag technology.. Its a great solution, highly recommended !! I will be posting an article shortly on how to set up clients to join the freeipa domain. I have it written already, it should be up within the hour.