Internal auth strictly over LDAP or SSH keys, so we don't have to worry about that. For external things we can't integrate into that we use a password manager

Internal auth strictly over LDAP or SSH keys, so we don't have to worry about that. For external things we can't integrate into that we use a password manager (self-made). People get dropped into the categories they're supposed to access, and done.