Enable Azure Active Directory driven Single Sign On on SAP GUI and Fiori launchpad

Hello,

One of our client has a requirement to allow Single Sign On for SAP using Azure Active Directory.

Azure documentation clearly lays out process for SAML and OAuth based SSO for 'web access'. So, we're certain on how to accomplish this for Fiori launchpad and app.

However, how do we setup Kerberos based SSO authentication for SAP GUI access in this scenario? S/4HANA app servers are on Linux just like SAP HANA. Needless to say, we need an easy on the wallet solution but of course remaining compliant with yearly licensing audits.

Please help.

Thanks, S