I am trying to implement SSO for my application. My application currently runs on Tomcat application server, I heard that its not possible to implement SSO (install web agent) on application server rather we need a web server which directs the user to the application (running on application server). Is that right? Can someone confirm?
It depend what tool / framework you use for SSO. For example, JOSSO supports Tomcat: http://www.josso.org/confluence/display/JOSSO1/Setup+JOSSO+Agent+%28SP%29. Please look in your product support matrix if Tomcat is supported.
In addition there is SSO feature in Tomcat that allows to perform SSO between application deployed in Tomcat: http://tomcat.apache.org/tomcat-7.0-doc/config/host.html#Single_Sign_On
Since our SSO provider didn't support tomcat application server, I integrated the Apache webserver with tomcat application server using mod_jk. The SSO module was loaded to Apache webserver which acts as a middle layer between User and tomcat application server. User first access the application via the webserver IP address which does the authentication, once the authentication is complete it routes the user to the application running on Tomcat application server.
来源：https://stackoverflow.com/questions/15486849/sso-integration-with-apache