Touching on the SAML point, if you have Shibboleth IdPs in your infrastructure then you can use that. I know you can tie Shibboleth IdPs to CAS, but have no experience of this or which way(s) round that goes.
We use Shibboleth for eResources and Google Apps (whatever it's called now) SSO, and I have proved it works on a test site (passing through all the attributes I configured our IdP to release). Admittedly that uses LDAP as its attributes/credentials source.
But until we have our Shibboleth picking up AD logins from the desktop, we're sticking with AD authentication for moodle as that's SSO from the desktop (unless you're on a Mac - we aren't using the Kerberos Apache plugin and the Macs don't talk NTLM).