Initial point: at the moment, JBoss's SSO feature uses a cookie to track the sso, and that cookie is scoped to a single hostname. So, if the URLs to your two apps were like this:
then Clustered SSO would work. If they are like this:
it won't work. I would expect that if the 2 apps are hosted in completely different locations their URLs patterns would be more like the 2nd case.
We certainly have users who run a cluster over a WAN, and you can configure ClusteredSSO to use its own cache, which would have a JGroups config tuned to running over a WAN. Biggest difference from the default JGroups configs that JBoss uses is the use of TCP instead of UDP. I can explain more about that if the URL issue above isn't a showstopper.