Nitpick - AD supports a centralised topology, but is more effective when decentralised. You can deploy as many domain controllers as you like, you can separate

Nitpick - AD supports a centralised topology, but is more effective when decentralised. You can deploy as many domain controllers as you like, you can separate global catalogues entirely, and deploy multiples of those, and you can even separate domains within forests, and then create cross-domain trusts. If you want to create cross-forest trusts you can do that using Active Directory Federation Services (ADFS). ADFS is hugely under-rated, and is arguably the most capable identity federation software out there because it's the only implementation I know of that does both passive- (browser-based), and active federation, which allows you to authenticate against AD from your JSON service. That story gets even better with U-Prove (http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/uprove.aspx http://www.microsoft.com/mscorp/twc/endtoendtrust/vision/upr...).