This OpenSSO tutorial is probably the best "getting started with OpenSSO" tutorial around, but I'll add one caveat to it: Until you know what you're doing, just follow this tutorial to the letter, and I mean to the letter. Specifically, when they say "use Glassfish", you want to use Glassfish, and not something else, like Tomcat.
There's no telling how much time I lost getting started with OpenSSO because I insisted on using Tomcat, specifically Tomcat 6.0.18. It turns out there was some problem with this specific version of Tomcat, and the OpenSSO agent for Tomcat. I kept blaming myself for it all not working, only to find out about this bug after doing some research. (I didn't realize it was such a low-level problem at the time, and would have needed to put things into debug mode to find out what was really happening.)
Switching from Tomcat to Glassfish
Once I switched from Tomcat to Glassfish everything worked as advertised. And that's why I say that your first time through with OpenSSO, just follow that tutorial to the tee, then deviate from there once you're sure you know what you're doing.
Here are the software versions I was using when writing this blog post:
- OpenSSO 8.0
- Tomcat 6.0.18
- Glassfish, v2.something