In some cases, such as when using RSA SecurID[*], the users real password needs to be fetched, before SSO is possible. The program tl-sso-getpass provides this functionality. Typically, this program is launched from xstartup.d. Another idea, however, is to have vsm-single-signon call this program automatically if there is no single-signon password. For example, if a WTS via tl-run-winapp is used, and the user starts Word and Excel, then the system would ask the user for his password when Word is about to start, but Excel could be started without asking for the password. On the other hand, most users probably expects the password prompts during login. Also, let's see if we'll get any SecurID users. [*] Another case would be when logging in via SSH keys.
See also bug 1418 for some background information.