Question: I'm not entirely sure if this is the right site for this, but I'll give it a shot.

Basically, I'm looking into different ways of setting up a single sign-on service for an existing corporate environment. Within this environment, there's anything from old legacy systems to new web services, all running on different platforms.

I'm not really looking for specific solutions, as much as high-level approaches/strategies. I found a [great writeup here](http://www.tml.tkk.fi/Opinnot/Tik-110.501/1997/single_sign-on.html#modcommon), but it's from 1997, so it's not exactly up-to-date. If you know of a similar, but newer, paper, please post a link to it. If not, I would be eternally grateful if you were able to contribute with information on more modern models that haven't yet been brought up. If you have implemented such a system in a similar environment, I would be very interested to hear how you went about it, and why you chose that specific strategy.

If this question would fit better on another site, please leave a comment and I'll post it there instead.

Thanks!

Answer: 
You may be interested in [seccomp](http://en.wikipedia.org/wiki/Seccomp). This is a feature with which Linux runs a process with only a very limited set of available system calls; the kernel kills the process at any attempt to execute any other call. This is, conceptually, the Right Way to do this kind of isolation: use a (small) whitelist of allowed system calls, instead of a blacklist of disallowed calls. Seccomp can be used by chromium (the opensource side of Google Chrome) so there's good chance that it will remain supported for the time being.

The Wikipedia page has a few links, including [seccomp-nurse](http://chdir.org/~nico/seccomp-nurse/), which might be the software you are looking for.

For CPU time and memory consumption, the Linux kernel can enforce hard limits on a per-process basis; see [setrlimit](http://linux.die.net/man/2/setrlimit).
You should probably run the program inside a virtual-machine, probably created using [Xen](http://en.wikipedia.org/wiki/Xen) if you don't want to pay for VMWare.