Don't know about the purchasing part. The portlet code itself should be portable. The actual portlet deployment process and how portlets are configured to integrate into page layouts differs radically across portals. You want to muck around with the free download before spending money; BEA portlet/portal documentation takes a fair bit of effort to wade through. You might get more feedback on people's experiences by asking portlet questions in the JavaRanch group for portlet development.
On the SSO side, companies often integrate with security systems not created by BEA, using stuff like Entrust. There is a group here on JavaRanch that talks about java security, this would be a good question to ask there.