Cross site authentication

I'm just wondering how cross-site authentication is handled for completely external companies? e.g. My site acts a "portal" onto another completely开发者_JS百科 external site.

Is there a standard way of doing this so the user is not prompted to log in again?

I know with e.g. eBay-> PayPal you have to re-authenticate, but is this the only/most sensible way?

It's going to depend on what that other site uses as an authentication method.

Look at SAML (which in essence a way of saying to the other site that they can trust your assertion that this user is who you say he is). OpenID is another system doing much the same thing.

In general, this is federated identity management,

In my opinion the best way to do this is to create a third application which is responsible for authentication and permissions. I've written a blog entry about one such application I've created for my own pet projects.

http://www.netortech.com/Blog/Entry/12/Web-passport-services