title: SSO for two applications that use different identity providers
body: <p>I want to perform SSO between two web apps. Here is my scenario:</p>
  
  <p>Apps A &amp; B (both provide RESTFUL API). <strong>App B uses form based authentication and I can not make any modifications to app B. Also, app A and app B maintains different user stores for authentication.</strong></p>
  
  <p>User registers in App A and after successfully registering, it logs in to app A and calls an API from app B that require user authentication.</p>
  
  <p><strong>The goal is to ensure that once user logs into app A they should be able to call authenticated API of app B without the need for logging in app B again.</strong></p>
  
  <p>I went through the cloud based SSO solutions provided by PingIdentity, Stormpath and few other vendors and it looks like for SSO across multiple applications require that either all the applications should trust same identity provider or the apps should understand SAML/Open ID. Also, it would require me to change the way app B handles authentication (but I can not make any changes to app B.</p>
  
  <p>I have thought of simple solution for my scenario (which in a way is also an SSO approach <a href="http://www.opengroup.org/security/sso/sso_intro.htm" rel="nofollow">http://www.opengroup.org/security/sso/sso_intro.htm</a>)</p>
  
  <p>Once the user logs in to App A, the server will make a background login call to App B (using pre-configured default credentials for App B). In response to this  login, app B will issue a session cookie which would be passed in subsequent API calls to App B.
  This approach has drawbacks of using default credentials for app B but it's simple and would work.</p>
  
  <p>However, before going this path, I wanted to know if this scenario can be handled in different way using standard SSO solutions ? </p>