I think private CAs are a mistake if only because of all the time wasted on certificate errors from improperly configured platforms. Don't forget that some languages don't respect system stores.
How do you enforce authentication standards in that kind of environment, let along an internal user directory?
No software can enter an environment completely unconfigured and be expected to work.