Are there any articles that go in to detail on exactly how to do this?
https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_...
More recently the AuthorizedKeysCommand patch has made it's way into Ubuntu's sshd, similarly allowing sshd to call script that looks up a user's authorized keys from LDAP.
1. https://github.com/AndriiGrytsenko/openssh-ldap-publickey
"The audit component of the project will remain deferred until further notice. You can see the reasoning in the About page."
Therefore, for enterprise purposes, I can't see why anyone would take FreeIPA seriously.
You also need to teach your users how to get kerberos tickets and setup keytab etc. Chances are if you are using kerberos you also have LDAP however.
Nothing says you can't put resources in multiple Kerberos realms either. Then you can establish a digraph of trust chains across Kerberos realms to transfer tickets across realms based upon some business rules.
There's many reasons that Active Directory (LDAP + Kerberos + some magical bits of quirks and features) is the gold standard for large corporations and the reason is not "nobody got fired for buying Microsoft."
Yes you need to be careful with it, I ran it on an internal VM, with only 2 users who had access to the admin console.
I'd love to see something as simple to use as keybox based around LDAP, I've had a google and can't see anything.
I wish people would just stop with these things. The appropriate way to be able to manage many users is called LDAP, it's been LDAP for decades and it's unlikely to change.
These days it's super easy to use SSH keys with LDAP, still using the standard openssh-lpk schema but now not requiring any patches to OpenSSH itself, just need to use the AuthorizedKeysCommand and an appropriate helper (which normally ships with distro).
By forgoing the above gateway style thing you now have central key management without a single point of compromise. Revoking a key is as simple as deleting it from LDAP or disabling that users account.