Multiple apps doing kerberos

Yes.... that is a current limitation of APM Kerberos SSO. It basically means that if all of your services are in a single domain realm, you can only have one Kerberos SSO profile and AD delegation account. If the services are in different realms, this shouldn't apply. The alternative is to create a single Kerberos SSO profile, and then use either reverse DNS or SPN patterns and %s wildcards to dynamically generate the SPNs to be used.