I'm not aiming to access restrictions. I want to take the advantages of the existing abstraction layers over the identity management: glibc/nss, sssd, pam...
Our goal is the support of different scenarios:
- Local Samba AD DC on NethServer
- Samba AD DC on another, remote NethServer
- Remote MS AD
- ...
If our services depends on the above standard system libraries (and dont connect directly to AD services) most of the integration work is already done.
@robb, what about a free AD replacement for schools? If you follow the wiki page you can deploy a prototype in minutes 
give it a try!