Red hat IDM, aka freeipa.

Depending on what youre doing you absolutely don't need active directory.

Hell, a lot of orgs are just going entra anyway. If you're using SSO like that or okta or keycloak you likely don't need AD.