SSO across multiple domains - looking for real-life feedback and ideas

Hi fellow pragprogs,

I'm currently documenting myself before implementing something I
consider to be a bit tricky: adding single-sign-on to a single
application serving multiple domains (some of them served on
subdomains like aaa.acme.com and bbb.acme.com, some other served on
'vanity' names like www.ccc.com).

There are a number of issues with this topic (like security itself,
how to stay in love with googlebot etc). Techniques include SAML,
cookies on a master domain. A nice implementation of this pattern is
http://www.pbwiki.com.

I'd love to get some input from people who implemented something
similar (or who thought about it).

cheers,

Thibaut