[Samba] Any howto about "single sign on" available?

[M. Mueller]

Hi all,
I would love to provide true single sign-on to my users, but it seems 
hard to find any precise information. I have already single _source_ of 
sign-on (ldap), but for services like IMAP (cyrus-imapd) or some web 
pages (Apache/Tomcat) users still have to type in their password.
If I got it right, I need winbind, but if I "google" for any helpfull 
documentation, I find a mixture about howtos explaining single source of 
sign-on and some papers stating that single sign-on is possible. 
Somewhere Tridgell says that there exists a patch to cyrus-sasl for the 
cyrus-imapd, but does that mean i need a patch for every server to be 
single sign-on ready?
Could anyone provide me with any helpfull links?

Thanks in advance,
Malte Mueller