Hey Joe,
Yes, for sure you can do X.509 SSO in SAP without paying for anything. It's not that hard to setup in ABAP or JAVA. The trick is that the End-Users need a user cert in their browsers that Identify them. Then you can map off of that in SAP. SAP does require HTTPs for this to work though. It's a decent amount of work, but it can be done, I've done it.
--NICK