LDAP Kerberos 5 SSSD is pretty easy to configure and more or less maintenance free for a small set of servers and users. By my personal experience.
The costs usually come from complexity: every new user needs its credentials, guidance to services and help in error situations. New services need to be integrated to existing systems. But those won't go away, be the system anything.
The costs usually come from complexity: every new user needs its credentials, guidance to services and help in error situations. New services need to be integrated to existing systems. But those won't go away, be the system anything.