I’m planning to build a web app (“my app”) which is accessed by users already logged into another web app run by the customer (“their app”). The goal is that users don’t have to re-authenticate (re-enter their passwords into my app), rather their app should pass some information to my app that I can use to validate the user.
I know I could cook something up, like passing the user ID signed with a pre-shared secret key and some salt, but I was wondering whether there’s an existing scheme or library for this use case. My app will be in Python, both apps run on different machines under different domains, and I’d like to keep required changes to their app to a minimum.
I believe the most popular protocol for this sort of deal is OAuth. There’s a Python library for it as well.