Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.