Directory services are based on OpenLDAP with Kerberos (and not a Microsoft screwed-up version either). Actually, most of the services are standard UNIX or based on them. As far as development on the platform, there's Java, Ruby on Rails, PHP, Perl, Python, etc. without having to port anything, in addition to programming directly for the Mac in C, C++, etc.
All well and good. But I have to manage what I've got, and that's going to depend on what the developers actually produce, not just what's possible. You can bitch about how screwed up AD is all day long. Show me the Open Source 'Exchange killer' that management will buy and be willing to retrain everyone on, or replace ments for the list of vertical market apps we've got that are only supported on Windows platforms.