I looked at SAML, it's a possible addition to the service. It may be touchy to integrate (opensaml-java), but definitely doable.