I am a big fan of SAML identity providers, they are flexible and robust they also work with browsers and mobile clients and allow you to provide access and authorization to all of the systems and services. I really liked Sun's offerings in this space, OpenSSO. Oracle no longer supports it but a company ForgeRock, formed out of former Sun employees an OpenSSO maintainers, took the project and are continuing it.

I like OpenSSO because it provides a service layer that makes authentication and authorization look like just another service offering on your bus. That being said you do have to look at the architecture of the SSO provider some are easily scaled and some are not.