Choosing Kerberos (SPNEGO) Java library for web application single sign-on
===

I'm currently working on implementing enterprise authentication mechanisms in our Java web-application, including single sign-on. Windows networks are what we primary target at, and Kerberos sounds a reasonable choice. Sidenote: as far as I understand, the protocol used in web (HTTP) environment to SSO is SPNEGO, and it's basically a wrapper around Kerberos. Thus it sounds that Kerberos HTTP SSO libraries in fact are using SPNEGO -- correct me if I'm wrong. 

As I started investigating this topic, I realized that there's no obvious choice. Let me list those:

 1. [Spring security Kerberos/SPNEGO extension][1]. This was the first I looked at (as we are already using Spring security), but it seems to be stuck at v1.0.0 second milestone few years ago. Only this [SO question][2] gives slight hope it could be used for production.
 2. [WAFFLE - Windows Authentication Functional Framework][3]. Seems to be active and feature-rich. It can be 'plugged' as generic servlet, and also as a [Spring security filter][4].
 3. [SPNEGO SourceForge][5]. Seems very lightweight, provides HTTP Servlet filter, tutorials are easy to follow.

Are there any particular reasons to choose one option over the other? Are there any other options around?

  [1]: http://static.springsource.org/spring-security/site/extensions/krb/index.html
  [2]: http://stackoverflow.com/questions/11040883/spring-security-kerberos-extension-for-production-use
  [3]: http://dblock.github.com/waffle/
  [4]: http://code.dblock.org/single-sign-on-spring-security-negotiate-filter-kerberos-ntlm-wwaffle
  [5]: http://spnego.sourceforge.net/index.html