Configure Shibboleth IdP to SSO by Kerberos tickets with Windows 2012 server - open to bidding -- 2

A user, which is authenticated by his Windows account, should be logged in to a web application in a browser automatically. The web application is secured by Shibboleth (SAML2.0). Shibboleth SP and IdP are already working. Web-application is secured and servers are communicating by SSL (Thawte). - Web application server and IdP are running on CentOS. - Forwarding of Kerberos tickets needs to be done by the newest secure way. - Communication between IdP and Windows server need to be secured as well. - The AD will run on Windows 2012 server or Windows 2012 R2 server. The setup has to work with both. - The client OS with the browsers may be Windows 7, Windows 8.1, Windows 2008, Windows 2012 or Windows 2012 R2. All combinations have to work. - Browsers, that need to be supported are: FireFox, IE 10 or higher, Chrome. Well formatted step by step documentation needs to be created. We will check config steps on our own by setting up a new SP/IdP environment in another Windows Domain. 1st milestone for setting up in the current testing environment 2nd milestone for writing documentation 3rd milestone after we have tested setup and implementation with complete new servers on our own - We will provide access to our servers and an appropriate Windows Domain Environment through Teamviewer.