webgui OR sapgui works with Netweaver Sign-On 2.0, but not both

We bought the Netweaver Single Sign On 2.0 license and configured kerberos with transaction spnego on a pure ABAP system.  Either webgui sso OR sapgui sso works at at a time, but not both.

This allows webgui sso to work but breaks the sapgui:

snc/identity/as = p:CN=KerberosSID@MYDOMAIN.COM

su01 -> SNC tab:  p:CN=MYDOMAIN/JOESMITH

This allows sapgui sso to work but breaks the webgui:

snc/identity/as = p:MYDOMAIN\SAPServiceSID

su01 -> SNC tab:  p:MYDOMAIN/JOESMITH

How can I get both to work at once?  ... preferably without having to configure anything on the client desktop.

Warm regards,

CM