The attached patch is a first step aimed at enabling TC's SingleSignOn 
function to work across a cluster.

It includes the following:

1) Interface SSOClusterManager, which should be implemented by a class that 
provides SSO support across a cluster.
2) Changes to SingleSignOn (and related classes) to add an MBean attribute for 
specifying an implementation of SSOClusterManager to use.  If an 
SSOClusterManager is set, invokes it when changes are made to the SSO entries 
on the local cluster node or if the cluster needs to be queried for a non-
local SSO.
3) An abstract base implementation of SSOClusterManager that concrete 
subclasses can build upon.

FYI, I have also attached a concrete implementation, a 
JBossSSOClusterManager.  It uses the JBoss TreeCache to 
communicate SSO changes across the cluster.  I've tested this in the 
JBoss/Tomcat integration. I know you can't use TreeCache in TC because of 
license issues, but thought you might be interested in a concrete 
implementation.

Sorry, I haven't had a chance to look into how Tomcat's own cluster 
communication works.  If you're interested in this patch I can look into what 
it would take to implement a TC-only version.