A Microsoft ISA proxy server is between the client machine and the internet and Single Sign On does not work with MAC OS X.
OS X Safari does not support Keberos GSSAPI and SSO fails.
First Step is that Firefox can be used as an alternative to Safari.
The Quest Authentication Services kerberos ticket needs to be proxiable and no-addresses set. This can be done by setting the following parameters in /etc/opt/quest/vas/vas.conf.
no-addresses = true
proxiable = true
These can be set manually in vas.conf, in a group policy or by running the following commands.
# /opt/quest/bin/vastool configure vas libdefaults proxiable true
# /opt/quest/bin/vastool configure vas libdefaults no-addresses true