SSO across multiple domains and group membership check

Thanks Ngutierrez31. We have over 50 URLs in production and a similar number in dev, each of which will need specific LDAP group membership check to ALLOW access to. I am hoping to enable SSO across all of these and hoping that the membership check could be done during individual URL access and DENY (without NULLing the session out) if disallowed. Wouldn't this cause a bloated VPE?

If Webtops allow creation of ACEs and ACLs ahead of time (and as and when new ones need to be created via an API), I am guessing any user's full ALLOW list is created during the initial sign-on... Is that correct? If true, this might solve what I am trying to do.

Regards - Prakash