A good trade-off between effort / rework and the convenience of single sign-on is to continue to maintain your list of users, privileges, roles, etc. in an outdated application. Make the necessary changes to automatically register the user in your application based on their user account (usually their Windows or network account).
I am currently launching several applications that use this login method, and this makes them seem more integrated, even if they are not.
Another advantage we discovered is that it prevents users from using passwords for legacy applications. They are much less likely to issue an administrator password, which also gives others access to their email or salary information!