Our authority for authentication is Active Directory, it may sound very enterprise and not-hip but it's great because basically everything supports it. A user just needs one password for all our systems - email, servers, laptops, internal applications.

For servers we use LDAP, so you just SSH to a machine and it creates an account if one doesn't exist. It authenticates against AD every time, so if an account is disabled there, their access to all servers is instantly revoked. You can still use SSH keys so you don't need your password every time.

Internal web applications (mainly Rails) are backed by LDAP too, but also support NTLM SSO for Windows uses (so they only need to enter their password once when they log-in to their machine). Not everyone uses Windows (or is part of the domain), so we use CAS on top of that to make switching between applications transparent for everyone.

We don't really use any external services that we need to share passwords for.