You have to have a central user store, which means a directory service of some sort. These days that means Active Directory, eDirectory, OpenLDAP, or some other LDAP-style server. Then that central server can talk different kinds of authentication protocols with the understanding that sooner or later the authentication service will talk back to the directory service and that the directory service will probably be talking LDAP. This is the case even if the directory service has its own API because everything speaks LDAP so applications generally use that nowadays.
Active Directory, of course, is the simplest choice to make these days since Microsoft has pushed it pretty strongly to be ubiquitous and it meets most needs.
I prefer eDirectory because it has very great stability and scalability, is more Unix-friendly than AD (both for clients and servers), and has a replication model that cannot be beat.
Openldap (and its derivations including Apple's Open Directory) is much cheaper and modifiable than the others, being the open source entry, but my impression is that it is a bit more fragile in large deployments and management is messier.
There are some other LDAP servers out there as well (such as Oracle Directory Server which might fit in well with your Sun boxes), but I am less familiar with them and so cannot give firm details. Given that you seem to want to avoid LDAP, you might want to check which authentication methods each directory service supports for Unix servers and base your decision on that.