Re: SSO across multiple domains - looking for real-life feedback and ideas

I would consider Yale CAS for that problem. It has been assessed by
faculty members and tested by students, it is simple and has a lot of
implementations, it is easy to setup a backend user lookup into LDAP
or whatever you have. The system as is has a dummy backend. There are
clients for a lot of different architectures.

http://www.ja-sig.org/products/cas/index.html

The architecture is simple and similar to kerberos. You need a single
server for CAS and you might integrate external sites with no
modification to the server, they might even federate identities
management with your server with no support. This allows a student to
set up a web site authenticating fellow students wihout any central
support.
This is the architecture of CAS version 1 (simpler)

http://www.ja-sig.org/products/cas/overview/cas1_architecture/index.html
-- 
Michele Costabile (http://proxybar.net)