Active Directory uses Kerberos for authentication, it's safe to say it's pretty widely used outside of MIT. :) Our user accounts live in an AD DS. We use FreeI

Active Directory uses Kerberos for authentication, it's safe to say it's pretty widely used outside of MIT. :) Our user accounts live in an AD DS. We use FreeIPA (actually Red Hat Identity Management) to manage a second domain for Linux stuff. There is a trust between the domains so that users can log into systems with their AD credentials. It all works pretty well; most of my frustrations with the system are because of AD's limitations (chiefly, lack of built-in MFA; awful documentation; lack of decent tooling for creating keytabs & configuring resource-based constrained delegation, seriously, I can't believe how bad the AD admin tools are) and flaws in how we have configured AD (obsolete protocols and ciphers still in use; the trust is one-way so users on Windows machines can't authenticate to services in the FreeIPA domain). This is for logging on to end user devices & accessing servers. Web apps we don't configure (any more) to use LDAP for authentication, rather OpenID Connect (against Azure AD, the confusingly similarly named service from MS, that syncs user accounts from AD DS). Where web apps want access to Kerberos-protected resources, we have some... interesting... setups to allow web apps to use constrained delegation to impersonate the users who have logged in (and this is another thing about AD DS that surprises me... it's incredibly easy to create a service principal that can impersonate any user when authenticating to a resource, including highly privileged users... there's nothing anywhere near as flexible as FreeIPA's Service Constrained Delegation mechanism, that can say "this service can impersonate anyone in group A to resource B") CI/CD is a bit too advanced of a concept for our AD audience :), we just keep an eye on the platforms and products that our users use & make sure they're doing the right thing with respect to token handling, etc.