By the way, I should've mentioned this -- you can get WS-* -based federation without having to "adopt a WS-star XML-hell enterprise standard". The way you'd do

By the way, I should've mentioned this -- you can get WS-* -based federation without having to "adopt a WS-star XML-hell enterprise standard". The way you'd do that is by putting ADFS or another WS-Federation-capable proxy (UAG, maybe) in front of your Django/Node.js/etc. app. All you need to do then is to deal with claims. Not even, if you have something like UAG transform claims into AD roles. Note that that approach doesn't rely on AD. You could use a flat text file, XML or SQL Server. And while I'm here - coding up something that uses a non-ideal technology (XML) is still a better option than re-inventing the wheel. 'Specially in this context.