If you have a bit more control over your servers, Shibboleth might also be an option. This has actually simplified most of our application, which caters to thousands of users, and is well thought out, flexible, and scalable. Basically, determine the directory on which credentials should be looked, and Shibboleth will take care of the rest.
Josh source share