Warren,
I thought that might be your answer :-)
If you don't want to buy any product, then you will have to build/find your own SNC library, perhaps using open source Kerberos, and use that Kerberos library with the SNC interface included in SAP NetWeaver and SAP GUI. Then, user will logon to a Windows workstation, authenticate against MS AD domain, and their Kerberos credentials will be used to log them onto the SAP system without them being asked for a password. The session is also encrypted using Kerberos session keys.
Disclaimer... Going this way however, even though it looks free, there are hidden costs and it is not something I would recommend. It won't be supported by anybody, so if you find users can't logon to your production SAP systems, you won't get help from SAP to fix it and you will have to fix it yourself. Over the past 20 years or so I have come across many companies who have initially gone down this route and then found that the risks associated with not having any support are quite high, so they eventually buy a commercial product instead such as the one from my company or from SAP... You get what you pay for, so if you pay nothing for the license you can expect to miss out on something else (e.g. support) !!
Thanks
Tim