Just use kerberos. You don't need LDAP to use Kerberos (although you probably should be using LDAP too). Kerberos without LDAP is trivial to set-up and administer, and it's very non-invasive, so you don't need to do any significant changes to your organization.