Multiple apps doing kerberos

JdTokenRing,

However if we did this same practice to say Sharepoint which uses host names for site rendering and its running under a service account, is that where I would need to configure that account for delegation and add a SPN for it in particular?

Yes. You just have to make sure that APM is requesting a ticket for the correct service principal name.

Is there a good Kerb reference you would recommend?

The Kerberos RFCs (1510 and 4120) are a great (albeit dry) place to start, plus there a few books on Amazon that give it decent coverage.