Kerberos is also acceptable, it is however much more complicated than LDAP for the average sysadmin to understand.

You also need to teach your users how to get kerberos tickets and setup keytab etc. Chances are if you are using kerberos you also have LDAP however.