A potential issue spotted by James Phillpots is that our ssoadm scripts composite a classpath including all the .jar files in the lib/ folder distributed with the tool.
The concern with this is that we may near the character limit for a command pretty soon - especially if client X deploys the tools to a directory with a long path. It would be better to use a jar that bundles up the (lib/*) classpath into a manifest entry, then include that single jar in the classpath.