I've used FreeIPA with great success in the past. It really took care of the client onboarding and replication and hid all the ugly complexity behind it. UI was also pretty dang good.