Parsoid needs to call the MediaWiki API and I guess the authentication for that process is the problematic part? It can forward cookies but that's no help with most SSO systems.

The simplest solution might be to create a new auth method (as a separate extension) that just uses some secret only known to MediaWiki and Parsoid to sign Parsoid requests. It could be allowed to impersonate any user (so that view permission checks work as expected) and it could use some grants-like mechanism to prevent write access for extra paranoia (since Parsoid does not need that).

I just ran into this problem with a client today. I'm wondering if @Osnard has a better solution, but I just commented out the bit in Auth_remoteuser that munges the cookie name.

For our customers, we use "Extension:Auth_remoteuser" with LDAPStack.
So this it how we handle it:

1. Enable kerberos authentication for all incoming requests (mod_auth_kerb for Apache; "NTML/Kerberos authentication setting" for IIS)
2. Create a bypass for calls coming from Parsoid (In IIS this must be a dedicated "Website" that allows anonymous access on a custom port, as one can not add exceptions to the authentication rule). This bypass must be configured in a way that only Parsoid can call it!
3. Parsoid gets configured to forwardCookies
4. In the wiki settings we add a special configuration that sets the $wgAuthRemoteuserUserName

Example:

$wgAuthRemoteuserUserName = function() {
	global $wgDBname;
	$user = '';
	if( isset( $_SERVER[ 'REMOTE_USER' ] ) ) {
		$user = $_SERVER[ 'REMOTE_USER' ];
	}

	//Bypass for Parsoid calls
	if( isset( $_SERVER[ 'REMOTE_ADDR' ] ) && substr( $_SERVER[ 'REMOTE_ADDR' ], 0, 4 ) == '127.' ) {
		if( empty( $user ) ) {
			// check the "304f3058RemoteToken" name of your cookies in your browser!
			$user = $_COOKIE[$wgDBname.'304f3058RemoteToken'] . '@DOMAIN OF CUSTOMER'; 
                        //$user = 'DOMAIN OF CUSTOMER\\' . $_COOKIE[$wgDBname.'304f3058RemoteToken']; //If `domain-backslash-username` is configured in `$LDAPAuthorizationAutoAuthRemoteUserStringParser`
		}
	}

	return $user;
};

That's it. So we basically set the "remote user" from the value in the cookie send by Parsoid. The important thing is, that this bypass must only be callable by the Parsoid service!