> Also, how hard is it to set up/care/feed a basic directory service?

Setting one up is pretty easy. The problem comes in when you find yourself depending on it, and then it gets out of whack, or Just Grows and you've got OUs and CNs all over the place.

At my last employer - a mid-sized manufacturer - we had several Tier II apps. These must be in working order or production is shut down. The shop floor application. Core ERP. Email. Above II is I which are applications that must exist or the company cannot operate.

There was only one Tier I application: Active Directory.

I burned a couple of weeks trying to setup a replicated freeipa environment. I was amazed that I could start with a brand new instance, run the same script and end up with different problems every time.

I can't say for certain, but I'd think a lot of this is actually built on top of OpenLDAP, with Samba just providing the compatibility layer for Windows clients.