FreeIPA has provided this for a while:

https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_...

More recently the AuthorizedKeysCommand patch has made it's way into Ubuntu's sshd, similarly allowing sshd to call script that looks up a user's authorized keys from LDAP.

This is a great perl script that makes for an easy AuthorizedKeysCommand [1]. SSH with LDAP is definitely an easier way to distribute keys and manage permissions than logging into each box. It's also a single point of failure in a way, but you can at least keep it completely inside a private network, and LDAP is well-known and easy to secure.

1. https://github.com/AndriiGrytsenko/openssh-ldap-publickey

More correctly AuthorizedKeysCommand is in mainline OpenSSH, thus every recent release of all major distros have it.

The IPA in FreeIPA stands for "Identity, Policy, and Audit". Yet on the Roadmap page (http://www.freeipa.org/page/Roadmap), enjoy this statement:

"The audit component of the project will remain deferred until further notice. You can see the reasoning in the About page."

Therefore, for enterprise purposes, I can't see why anyone would take FreeIPA seriously.

Digital Ocean has a ton of systems management guides aimed at developers first, but they're pretty reasonable for small scale setups and when you have no clue where to start. https://www.digitalocean.com/community/tutorials/how-to-auth...