Centralized authentication can be a problem when you can't ensure a robust enough protocol for all applications and you often fall to the domain of the lowest common denominator.

Another pitfall is when people centralize both authentication and authorization which leads to allot of issues mostly loss of granular control over permissions and information exposure.

If you are using some sort of SSO/Global Token based authentication you should let your applications handle the authorization, and you should not store information about the user's privileges within the token itself.