I'll second the mention of Shibboleth. It requires each site to trust the other site, but the actual auth work still happens at the local site. We are looking into this at UB for access to other Universities and it is open source.