- Setup a Shibboleth IdP (www.shibboleth.net)
- Configure it to do Kerberos (https://wiki.shibboleth.net/confluence/display/SHIB2/Kerberos+Login+Handler) and configure the browser to behave https://wiki.shibboleth.net/co...
- Federate with Google Apps
User authenticates to machine & SSOs over to Google Apps & done. Since it seems that you're in Wisconsin, contact the IdP folks at UW-Madison: email@example.com. They can likely assist you with setting things up.