Comment by antifuchs

Did you consider SSL client auth? I'm not sure you will get all the properties you want out of it (ease of logging out, especially); but having used it a bit now, it is a really pretty nice way to do SSO. Plus, it forces you to keep your internal services on HTTPS which is just a good idea anyway (-: