LDAP is not a certain product, it is a protocol. The product "openLDAP" just implements this standard (like a network driver implements TCP/IP or a disk driver implements SCSI). LDAP itself is a - somewhat stripped-down - version of an even more complex and more general protocol, DAP, which itself is part of a protocol family called X.500. X.500 used the OSI-protocol stack, whereas LDAP works on TCP/IP, which is just one of the simplifications.

Historically, Novell Netware embraced X.500 and implemented DAP as the "Novell Directory Services", later called "e-Directory". Today LDAP is the most widely use application of any DAP-implementation. LDAP might look complicated at first, but in fact it is as easy as it cat get at all. Directory services in fact *is* a complicated matter and without thorough planning you will likely not just fail but end with an unmanageable system.

The question if you should use LDAP or something else is, btw., wrong in itself: a Windows "Active Directory" is nothing else than an LDAP domain securified with Kerberos, which is just lacking good administration tools. When you are planning to do an installation-wide user administration and -rights management IMHO there is no way around one of the implementations of LDAP.

The big advantage is that there are LDAP clients for practically every system: all UNIX systems that i know of, Windows (there called "Active Directory", but also native LDAP implementations), even for z/OS (IBM mainframes) and iOS (better known under its former name "AS/400") there are LDAP-clients.

So i suggest you grit your teeth and start learning LDAP and one of its implementations (openLDAP is a good one but you probably want some administrative frontend to work with it - there are several to choose from). I don't see any feasible way around it for what i have understood you are planning to do. Do not underestimate the planning effort necessary to create a manageable and workable system. It is easy to change the system as long as it is not in place, but very hard - if not impossible - to change some things once you put the system to work.

I hope this helps.

bakunin