APM OWA 2010 webful/webreadyl

That's not SSO. An SSO is a separate profile that you apply to the access policy that interacts with the application in some way, ie. passing Kerberos token, NTLM challenge/response, HTML form post, etc. The SSO Credential Mapping agent in the visual policy really does nothing more than prepare the session variables that will be used by the SSO profile. For example, form post and NTLM SSO generally need username and password, while Kerberos needs username and domain. You need to determine what the application requires in the way of authentication, and then select/configure the correct SSO profile.