We Keep Coding

Add forms to a locked down Drupal distribution

We are currently using a third party Drupal distribution that is locked down due to contractual agreement.
What is the best way for us to add forms to our site that will post to a web service?
Options we considered are:
Deploy another open distribution (core) that we can add forms to and link from the third party site.
Paying the vendor to create the form for us on that distribution (expensive, long lead time).
Any other options?

It's hard to say without actually knowing the details of your contractual agreement.
With drupal a distribution is a set of modules and configuration that lies in the profiles subdirectory of your drupal file system.
So you can add additional modules outside of that by adding them to the sites/all/modules directory.
That way they are not actually part of the distribution but you can still use them.
So for example you can add a custom module that has the forms & web service posting to sites/all/modules and it won't impact the distribution at all.
However if your contract says something like you cannot modify your drupal site/configuration at all then I think you're pretty stuck in a crappy contract.
If you are in a contract where it is expensive & takes a long time to do something that sounds relatively straight forward (again I don't know the details but a form that submits to a web service is generally pretty straight forward) but you aren't allowed to go outside of them to do the work you're in trouble.
Deploying another site just for a form or a couple of forms doesn't really sound like a good idea.
If they belong on the existing site they should be part of the existing site.
If the contract really does exclude you from adding your own code to the site at all it comes down to discussing it with your website provider.
Surely if you aren't allowed to modify the site then there should be a clause that covers you in the case that they don't complete work in a timely fashion.

How to develop single sign on framework

I work for a company which prohibits the use of open source and, for some reasons, I wouldn't be able to buy a single sign on solution from the market. Is there some tutorial which could explain what is envolving in developing a single sign on solution? This can be done in Java or Dot Net as long it is able to communicate with LDAP. Any idea will be appreciated.

On the wikipedia page List of single sign-on implementations you can find a list of SSO implementations, there is a column indicating the licence. Some of them are open-source, you should start a comparison of them to find which best suits your buisness requirements.
I can't recommand you to rewrite a SSO from scratch, it will cost you more time than choosing an existing free and open-source implementation, and your home-made implementation is subject to security issues if you don't have the right expert guy working on it.

I'd go with SAML.
It's an open standard used for sso solutions. In fact, i worked at a company where we built our own SSO around this.
And for LDAP integration, you can build something by yourself, or check Microsoft's Active Directory Federation Server, which I think is SAML-compatible

Multiple domains one sign on (without logging in to each one)

I have been asked to oversee the development of a handful of sites. The people running the show want it so that if you sign onto one of the sites, then you are automatically signed onto the rest of them.
One of my buddies who is a great programmer says there is no safe way to do this, is he right?
I had an idea that the main site (parent site) could host the daughter sites as sub domains, with each site having its own unique domain name.
What do you think?

Yes, it can be done. However, it won't be a trivial solution but will be a very expensive project that requires an extensive set of skills. Companies typically try to achieve this by establishing internal solutions themselves but tend to fail as complexity increases.
What you are trying to accomplished can also be done as a service. You may want to take a look at the following webpage:
http://www.covisint.com/web/guest/about-identity-services
Hope that helps!

General Orientation Needed: What architectures/methodologies should I use to encapsulate a website to run on someone else's website (plug-in)?

I have a product in mind that requires the development of a website that should run within another organization's current website. So, this would be a website that offers functionality that many other organizations would want to host on their own domain and use their user's current login credentials. A plugin so to speak.
How do I develop a module that exists and interacts with their website on their domain? I'd like to avoid an API that requires them to integrate (other than the credentials issue which I don't know how to get around yet). I would prefer this to be a plug-and-play solution where they buy the software from me, host it, and it seamlessly integrate into their site.
I don't have any specifics to offer. I need a general orientation.

NOTE: ANDED from the comments above:
..without a popular platform, such as WordPress or Joomla, etc., that allows you to integrate with it and everyone who is integrated with it to use your plugin, there is no other way but custom integration with custom communications.

Can you extend Google Identity Toolkit to include facebook/twitter/etc?

I decided to look into using Google Identity Toolkit. I knew I liked the UI, and the idea of using a "federated" login system. I'm now having my doubts, as while my site works well with gmail/ymail/hotmail etc, it doesn't seem to support any of the social platforms.
Essentially, I just need an email address from people to be registered with the site, so I thought GITKit was the perfect solution.
Should I have gone down a custom route (like stackoverflow?), or have I missed some of the GITKit documentation?
Any help would be much appreciated.

I did do a fair amount of googling prior to posting that question. However, I have come accross some answers. Rather than delete my post - I guess I should share the information. If others thought the information was clear, please delete this thread!
Firstly, there is a page identifying how to add custom IDP's: https://sites.google.com/site/gitooldocs/customidps
There is also a sample site (http://www.openidsamplestore.com/localmapping/) which uses facebook.
How does the advanced demo work for identity providers who are not
E-mail providers, such as social networks?
The hardest part about
designing the advanced site was to find a way to handle all the
edge-cases that can happen with these types of identity providers.
Google previously published a summary of best-practices for
account-linking that describes why these types of identity providers
are so much harder to support. However this demo provides a user
self-service mechanism for all the tricky cases to avoid the costs
that a website might otherwise occur if those users contact a customer
support representative.
Finally, a best practices run-down is available here:
https://sites.google.com/site/oauthgoog/UXFedLogin/loginlogic
EDIT 1 :
If that identity provider asserts email addresses that it does not
host, we suggest you also implement additional account linking logic.
A future version of GITKit will add support for these type of
identity providers, such as social networks, which will avoid the need
to implement that logic
Perhaps GITKit is the future after-all... Would be nice to have an idea of the time-frame in which this support will be added though...
EDIT 2 :
Direct from the horses mouth (Eric Sachs # Google - Source Link):
That feature is not expected to be generally available in 2011. We
are shooting for Q1 2012

Looks like someone got it working back in Dec 2011 but there is still an outstanding issue with mapping the id returned to an email address. It was probably resolved:
https://groups.google.com/forum/#!searchin/google-identity-toolkit/facebook/google-identity-toolkit/2218yW4zXw8/28X7btJEh_sJ
Here is the documentation for the sample store including brief info on basic, mobile and advanced mode (using facebook):
https://sites.google.com/site/oauthgoog/Home/openidsamplesite
An out-of-the-box IDP for facebook and twitter has not yet been released.