Does the glassfish SSO implementation implement any standards? If so, which ones?
If I have a dependency on Glassfish SSO for my applications, will my applications be portable – will the SSO work if I deploy my applications to another web container such as tomcat?
It seems that the GlassFish implementation is based on the Tomcat valve org.apache.catalina.authenticator.SingleSignOn and not on a Java/Java EE standard.
It should be possible to port applications to other app servers that are based on Tomcat, though I would recommend doing some tests first.