We are working on an application with a multi-tiered architecture:

Browser talks to a Web App

Web App talks to a SOAP Web Service

Authentication is done via Active Directory

We want to implement SSO and we have the following requirements:

1. When a user is logged in into his Windows workstation, his login is used to SSO into the Web App.
2. When an application uses the Web Service it can use username/password as credentials.
3. When a Web App uses the Web Service the Web Service should be able to take advantage of the SSO mechanism of 1.

1. could be solved via JBoss Negotiation / SPNEGO

2. could be solved via Picketlink and an appropriate IDP

How about 3. How can we carry over the login information from SPNEGO to Picketlink.

What is the recommended way to ensure that all tiers of the application participate in the same SSO mechanism.