Answer
Add a new setting called 'SSO' to the client's Ifs.Fnd.Explorer.appsettings file, copied and renamed from the sample file Ifs.Fnd.Explorer.appsettings_sample found under <ifs_home>\repository\client\runtime, and set it to true. This enables SSO automatically for every user without needing the Shift-key-at-launch workaround. After saving the file, the client application needs to be re-signed via the installer for the change to actually take effect. Future client updates may update the sample file's own default values, but explicit settings already specified in your own Ifs.Fnd.Explorer.appsettings file are preserved across updates rather than being overwritten.