<p>We have a client/server application with a rich client front end (in .Net) and also an administration portal (Asp.Net). Currently users have to sign on in both the rich client and on the website. We'd like to enable them to sign into the rich client, but not have to  sign on to the website if they launch it from within the client. How can we do that?</p>

<p>Going the other way is less important, but would be nice if possible: signing on to the website, then not having to sign into the rich client.</p>

[{'answer_id': 81435, 'author': 'Paul van Brenk', 'author_id': 1837197, 'author_profile': 'https://Stackoverflow.com/users/1837197', 'pm_score': 0, 'selected': False, 'text': "<p>You could add a token, to identify them, to the URL which opens the site.</p>\n\n<p>You'll have to add some security to the token: TTL, a hash, a salt</p>\n"}, {'answer_id': 81444, 'author': 'Muxa', 'author_id': 10793, 'author_profile': 'https://Stackoverflow.com/users/10793', 'pm_score': 4, 'selected': True, 'text': '<p>A possible solution is:</p>\n\n<ul>\n<li>sign-in to the rich client</li>\n<li>a random token is generated by the server and stored againsed the signed-in user</li>\n<li>rich client gets that token from the server</li>\n<li>that token is used in the url pointing to the website</li>\n<li>going to that url (using a link or a button from the rich client) will auto-login the user and reset the token</li>\n</ul>\n'}, {'answer_id': 87945, 'author': 'Luke', 'author_id': 14275, 'author_profile': 'https://Stackoverflow.com/users/14275', 'pm_score': 1, 'selected': False, 'text': '<p>Make sure there is a timeout on the token, say 2-5 minutes, to ensure it is authentic.</p>\n'}, {'answer_id': 88049, 'author': 'Andreas Petersson', 'author_id': 16542, 'author_profile': 'https://Stackoverflow.com/users/16542', 'pm_score': 2, 'selected': False, 'text': '<p>simple token solutions suffer from a design flaw: you will have some sort of secret that can be reverse-engineered if wanted. this can be avoided entirely if dome correct.</p>\n\n<p>i would propose a challenge-response algorithm.</p>\n\n<p>*) user loggs in to rich client with pw</p>\n\n<p>*) from salt+password a sha256 or similar hash is calculated. (Hash A)</p>\n\n<p>*) user klicks "go to website" link.</p>\n\n<p>*) a http response is started (such as as a webservice), user fetches "get ticket number" for user account. this ticket will be valid for a short time (some minutes)</p>\n\n<p>*) client calculates hash(HashA+ticket) HashB</p>\n\n<p>*) finally - browser is pointed to www.example.org/?username=donkey&amp;key=99754106633f94d350db34d548d6091a</p>\n\n<p>*) server checks if his calculated hash is the same as the one submitted.</p>\n\n<p>advantages of this method:</p>\n\n<p>-server never knows password, only salted hash.</p>\n\n<p>-even the hash is never transmitted through the wire -> no replay attacks.</p>\n'}, {'answer_id': 88095, 'author': 'andyuk', 'author_id': 2108, 'author_profile': 'https://Stackoverflow.com/users/2108', 'pm_score': 2, 'selected': False, 'text': '<p>How about <a href="http://oauth.net/" rel="nofollow noreferrer">OAuth</a>?</p>\n\n<blockquote>\n  <p>An open protocol to allow secure API\n  authorization  in a simple and\n  standard method from desktop and web\n  applications.</p>\n</blockquote>\n'}]
['https://Stackoverflow.com/questions/81423', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1727/']