[stephenr]

But OP doesn't need AD semantics: he wants centralised auth for a bunch of apps hosted on linux.

This is ridiculously simple with OpenLDAP. The only part that's 'missing' is a self-service web UI.