Identity federation can be pretty complex to set up and administer, but once the trust relationship is configured and the identity mapping set up, it's pretty transparent to use. Source: I do this for a living.