APM SSO for OWA locking accounts

I am a little baffled by an SSO issue with APM portal. I have a portal configured that publishes Citrix, SSL VPN, and various internal web applications. Single Sign-On is required for Citrix and Outlook Web Access 2013. SSO for Citrix works flawlessly, but when you try to access OWA, the AD account is immediately locked out. The MS logs indicate that the password is incorrect, but it works on all other applications including Citrix. Any ideas?