There’s LaserWeb but apparently it doesn’t support closed source (Chinese) firmware so you’d need to change your laser’s controller…

The only alternative I know of that goes close to what FreeIPA does (minus the cert part) is kanidm. It does:

• oauth2
• ssh key distribution
• RADIUS
• PAM/SSSD
• LDAP

I just noticed they have a beta for multimaster replication, which is nice.

I use it at home. Note, though, that it does not do any hand-holding, and all configuration is done through CLI. Also note, there are docs for the stable or dev branch and there sometimes are big differences between the two.

Exactly this. In a federated network, the instance with the majority of users could dictate the protocol, forcing the smaller issues to continually adapt or die. See this post for a very real example of this.