This is a great perl script that makes for an easy AuthorizedKeysCommand [1]. SSH with LDAP is definitely an easier way to distribute keys and manage permissions than logging into each box. It's also a single point of failure in a way, but you can at least keep it completely inside a private network, and LDAP is well-known and easy to secure.
1. https://github.com/AndriiGrytsenko/openssh-ldap-publickey
More correctly AuthorizedKeysCommand is in mainline OpenSSH, thus every recent release of all major distros have it.
The IPA in FreeIPA stands for "Identity, Policy, and Audit". Yet on the Roadmap page (http://www.freeipa.org/page/Roadmap), enjoy this statement:
"The audit component of the project will remain deferred until further notice. You can see the reasoning in the About page."
Therefore, for enterprise purposes, I can't see why anyone would take FreeIPA seriously.
https://docs.fedoraproject.org/en-US/Fedora/18/html/FreeIPA_...
More recently the AuthorizedKeysCommand patch has made it's way into Ubuntu's sshd, similarly allowing sshd to call script that looks up a user's authorized keys from LDAP.