Install OpenSSO Enterprise instances on three separate host computers, preferably in different domains:
One OpenSSO Enterprise instance to act as the Service Provider
At least one OpenSSO Enterprise instance to act as the Identity Provider Proxy.
One OpenSSO Enterprise instance to act as the actual Identity Provider.