In ArkOS, centralized user management is a long-term goal, for which they are considering LDAP as a possible route https://lists.citizenweb.is/pipermail/arkos/2014-March/000067.html
In Yunohost, there is indeed LDAP-based SSO, combined with hooks like post-user-create (see https://yunohost.org/#/packaging_apps). I didn’t know that, that’s actually supercool!
Reading this post about draw.io on sandstorm gives a good idea of how things work on sandstorm - it’s kind of novel and different. in fact, i think given they run apps inside ad-hoc containers, based on wildcard DNS (the container listens on https://youruser-longunguessablehash.example.com/) using a sandstorm instance as your remoteStorage server would actually break their security model a bit.