SSO

Full Stack

 * KeyCloak - easy to integrate into freeIPA?

FreeIPA for LDAP management or Keycloak if all of your services support OAuth/SAML is probably the best way to go.

https://www.reddit.com/r/selfhosted/comments/89wc9o/_/

Partial

 * FreeIPA
 * OpenLDAP

Compatibility Layers

 * YunoHost SSOWat - Lua plugin for Nginx to allow LDAP SSO to existing password based systems.