FreeIPA and OpenLDAP are PITA compared to AD.

I hate windows but AD works pretty well and integrates with a lot of SSO functionality easily.

Modern IAM tools should fix any of the locked out / just fired users issues you speak of... by using AD.