I have a large network with more than 1500 PCs and 9000 user accounts in a university. We have classified users in 5 groups and are sharing bandwidth among them using MikrotiK's hotspot with NTTAC accounting backend. We not only control the maximum bandwidth/rate for a user but the time limitations to access the internet as well. In this scenario, all users are authenticated against a Active Directory server which runs NTTAC+ as well. We have set the gateway to a MikrotiK machine with a hotspot page which adds a forwarding rule for user traffic after hotspot authentication (although user credentials are the same and are authenticated against AD server, we do not use SSO to enable the user to work with local services when required and save his/her internet access time limits)
Now, the are some problems: 1 - It seems that with this large number of users, MikrotiK has been pushed to its edge and can not handle such a traffic with hotspot. 2 - the AD server has became a point of failure and its absence result in loosing many services.
Hence, I'm looking for best practices for large scale user-based (not pc/ip based) bandwidth sharing/shaping without having a single point of failure.