Seamless athentication to Webtop

Kevin,

As I try to implement this I've thought of a couple of more scenarios, that you might be able to confirm up for me:

"You're going to log in to the APM webtop seamlessly by virtue of Kerberos authentication from your domain-joind workstation."

This is exactly what I want to do. However would I also be able to have a fall back to the standard login page here if I accessed my webtop from a non corporate/non domain joined workstation, where attempting kerberos auth would fail?

And secondly (i might not be explaining this very well). Could I still access my SAML protected resources (SaaS based applications available over the Internet) seamlessly without having to seamlessly login to my webtop first (lets say I fired it straight from my browser favourites) from a domain joined machine? So the flow, I expect, would be from domain joined machine to Saas app, SaaS app redirects back to my iDP for auth, iDP does auth via Kerberos, SaaS app lets me in without requiring manual credential input. The next query would then be if I was on a non domain joined workstation accessing SaaS apps would that auth be able to failback to a login page, as the iDP is trying to do auth via Kerberos in the first instance?

Thanks for your help! I'm hoping I've come to the end of the road in terms of scenarios! :)