To my knowledge there is nothing like that single sign-on functionality. It is possible to install the plugin separately, as you can download the exe and run it. This won't avoid having to put in the credentials to get the desktop running, but will avoid them having to go and download the desktop installer. I just tested this and you can probably have it be part of a login or startup script. Here is what I did to install the ZAV desktop remotely without having to go to a site:

net use t: \\192.168.1.1\c$\apps /user: username password
t:\zav-plugin.exe /allusers /silent

Again, this just eliminates the need for them to go click on app to download the ZAV plugin. They will still need to actually log into the plugin to access applications

Thank you for the info

I am little disappointed that ZAV Portal cannot use the SSO, especially that the applications can be associated to Active Directory users and group. The user experience would have been more transparent.

I found instead, that after authentication in the portal, if you click on an application, when the plugin is already install on the workstation, this plugin sign in automatically. So if the portal can pass credential eventually, it will work like a charm.