Not that freeIPA is scrappy. on the contrary, it has been very good. Properly documented, and does the job well. The issue is finding another alternative for it as cohesive as freeipa in the Debian ecosyystem. FreeIPA is tightly integrated into RH ecosystem that it is prone to trouble when introducing changes to the environment it runs at. Can I make it run on Debian - Sure? But, will I trust such a setup for the critical element of our stack? NO.