Shortcomings

• Webauth provides SSO only for (redirectable) HTTPS services
• S/Ident and SPNEGO work around this, but neither has good coverage
• Keytab management, awkward to devolve
• One login per browser instance
• Logout issue confuses people