Hi Conrad,
there is not much I can add to what Samuli already said. If you want to get more info about the SAP NW SSO capabilities you can have a look at the NW SSO summary page that provides some more info on the product and capabilities.
Besides supporting what you want, it can be used with NWBC and other SAP tools as well. EVen if the software does not directly support Kerberos, the product can be used as it can act as sort of a bridge baseed on short lived X.509 certificates which are created based on a Kerberos authentication.
Regards,
Patrick