BPM Workspace with custom SSO

Question

We need to develop a new Single Sign On security provider to automatically authenticate Oracle BPM Workspace application.
Following some samples and tips from Oracle Forum, blogs[1], OTN Samples[2], and also the documentation[3] we build a new Assertion Provider.
We created a new MBean type, implemented the classes AuthenticationProvider, IdentityAsserter, and installed it at MBeanTypes folder at Weblogic Server.
The new Assertion Provider appears at realm providers and was configured without errors.
In this first test we develop a very simple authentication, just decoding the username from the new token and trusting it.
But when we try to call the BPM Workspace passing the new token in the http headers, seems nothing happend: the BPM Workspace login page it is opened and there isn't any message in the log indicating that the new provider has been used.
In fact we need to develop a SSO that receive the token at URL (not in the http headers) run a specific library to decrypt the token, check the token validity and proceed with the authentication. But at now we haven't even a simple sample working ...
Is it possible to have SSO at Oracle BPM Workspace only configuring a provider at Weblogic realm or we need to config/hack something at BPM Workspace application?
BPM Workspace web.xml it is already configured by default with these options:
<auth-method>CLIENT-CERT,FORM</auth-method>
<realm-name>myrealm</realm-name>
Infra:
RHEL 5.5 64Bits - Kernel 2.6.18-194.el5
Oracle SOA Suite 11gR1 PS2 - 11.1.1.3.0
Some references checked:
[1] http://fusionsecurity.blogspot.com/2009/07/building-custom-security-providers-with.html
[2] code-sample ID S224: Sample Security Providers for WLS 9.1
https://www.samplecode.oracle.com/tracker/tracking/linkid/prpl1004?sfLoginToken=088763F78B4F7961288649650A424AF3&sfProj=codesamples&isLoggedIn=true&id=S224&dapCheckedPassed=false
[3] Oracle® Fusion Middleware Developing Security Providers for Oracle WebLogic Server 11g Release 1 (10.3.3) E13718-02
http://download.oracle.com/docs/cd/E21043_01/web.1111/e13718/intro.htm

Answer 1

...seems nothing happend: the BPM Workspace login page it is opened and there isn't any message in the log indicating that the new provider...
Is there an Audit provider configured, which collects and stores the security logs.
To my knowledge, WebLogic uses the same cookie name (<code>JSESSIONID</code>) for all web applications on the server.
That way, no matter what type of authentication method is used in a particular web application, an authenticated user will have
single sign-on to all other web applications in the server.
If you want to have a global single sign-on a good solution would be to use Oracel Single Sign-On (http://download.oracle.com/docs/cd/E17904_01/core.1111/e10043/osso_d_10g.htm)
With your own implementation how is the authentication token mapped to a username?