We have done the following to deal with this at our place:
- The desktop icon for moodle (distributed to all AD college PCs and laptops) goes to wwwroot/login/ (so when they're on campus, it tries to SSO them)
- The homepage has the following on it (login form block + HTML block):
so if they just go to the homepage, they're reminded they only have to click 'login' and it will SSO them (but still have the manual login link, for us moodle admins).
The HTML block pulls in (using an <iframe>) a PHP script which detects if they're on site - we don't show any text in it if they're offsite (it looks at their IP address, we can tell if they're coming in via the reverse proxy that way)