I'm looking for the possible existing solutions to centralized user management. Most of the documentation found online refers to LDAP (Active Directory in particular) but I would like to know if there are other alternatives which might be better suited for the result we want to achieve.
Current situation
We currently have about a dozen servers, some bare-metal, most virtualized (VMWare) running at our company. Most of them are Windows Server but some are Linux as well. We have 2 networks (DMZ and private) in our department, not every server is connected to both networks. At the moment we have set seperate user accounts for everyone on each server (if they need an account on that server, not everyone requires access to all of them), with their individual permissions. Our users can login through Remote desktop, SSH or through Microsoft SQL Server depening on the type of server we are dealing with. The client computers our employees use to login on the servers are already inside an LDAP configuration, which we can not use for our servers. (This LDAP is being maintained outside our department). The problem with this setup is that now whenever we have a new employee, or more regularly, an external consultant coming in, we have to create a user account manually on each server and set their required permissions. Resulting in some server managers not even bothering and just using the Administrator accounts.
Desired situation
User accounts are created once for the entire server park and are assigned to user groups, through these user groups the user will automaticaly get the derived user rights on all relevant servers. Users can then login on the servers with their username and password through either Remote Desktop, SSH or SQL Server (SQL Server Access can be linked to Windows User Groups). Preferabbly Administrator accounts would be locked and the servers remain accessible/operational when the central user management server goes down.
What I'd like to know
I would like to know which different technologies (not specific products) exist to achieve this goal and if possible what their pros and cons are. Some technologies I have come across are Puppet and Metadata, however they don't really feel like proper solutions to me. Although, I find it hard to believe Active Directory would be the only working solution in existence. But of course, if it is, I'd like to know why :).
