App Tunnels and SSO

Do you mean app tunnel, as in a limited SSLVPN connection, or an HTTP portal rewrite config? An app tunnel is generally just a tunnel into an environment and you're going to be challenged to do SSO here. But a portal rewrite can either have an SSO profile assigned to it, or (as I usually prefer) you can point the portal config at another VIP that gas its own access policy and SSO assigned. The beauty of this method is that the credentials collected during the initial authentication would be available to any access policy and/or SSO profile behind that. So if you collected username and password on initial entry, you could create separate SSO profiles for Forms, Basic, and NTLM on the server side.