FreeIPA is pretty good for internal users when money is tight. It's a FOSS almost AD but for *NIX and it does HA. For the SSO part, Shibboleth2 or CAS.