This questions is verty pertinent to us, if someone could add their input, or links to possible solutions, it would be appreciated !
Doing this is really difficult depending on the SSO environment you're doing it with.
There is a tracker item for it - https://tracker.moodle.org/browse/MDL-29583 - attached is a patch that makes webservices work like this for Shibboleth (at least for most Shibboleth installs!), though it wouldn't be particularly hard to adapt it for other SSO flavours where the webservice user has to go off and essentially log in behind the scenes.