Has anyone done any inroads in creating or implementing Enterprise Single Sign-on solutions of any kind? I'm specifically talking about both handling user and account management across heterogenous environments in a unified way, plus having credentials management and aliasing to support single sign-on across applications (such as the case of application X calling application Y calling application Z on behalf of user A).

This is a topic I've recently gotten interested on based on some of the difficulties I've seen on some of our clients, and would love to hear any stories "from the trenches" :)