There's a reason huge enterprises still pay big money for stuff like CA's Siteminder: it's way easier to bolt an agent along side your crappy internal app that thinks about this stuff for you.