FreeIPA (IdM on RHEL clones) is similar in some functionality (you join the domain, you allow certain users/groups can run certain commands [like controlling sudo’ers], etc.) and it’s also a CA).

For configuration management I lean towards Ansible (Puppet, Salt, Chef I think all use a Ruby syntax, Ansible is YAML), and for deployment well Terraform, Kickstart and cloud-init - without knowing your environment it’s difficult to be more precise. There’s also Pyinfra which I’ve been meaning to give a whirl but not had a chance.

You’ve also got Keycloak if you need OIDC or SAML functionality (for SSO).