Single Sign On is implemented by sharing cookies and sharing user table(s).
There are two tables that control the users. The first is "users", which contains the basic information - username and password. It is shared when the SSO add-on is activated. The second table is the "usermeta" table, which contains the roles. This one is separate per site, by default.
Sharing the Usermeta table & roles requires some changes to the core, unfortunately. You can do this by doing the following:
Add to wp-config.php:
define('CAP_PREFIX', 'wp_'); //(change the "wp_" to the same prefix found in WP-Admin > WP Hive > SSO Options)
Change the following in wp-includes/capabilities.php:
$this->cap_key = $wpdb->prefix . 'capabilities';
to this:
$this->cap_key = CAP_PREFIX . 'capabilities';
If you allow a new user to register, they will be given the default role for each site, which is set in WP Admin > Settings > General > New User Default Role
I hope to make this a little easier to do in a future version.
I hope that makes sense...