title: How to implement IdentityServer4 SSO based on password flow?
body: <p>I have two web app:</p>
  
  <ol>
  <li><p>webApp1 in domain1
  (Spa1 -> WebApi1 -> IdentityServer4 -> db1)</p></li>
  <li><p>webApp2 in domain2
  (Spa2 -> WebApi2 -> db2)</p></li>
  </ol>
  
  <p>User story: </p>
  
  <ol>
  <li>End-User John already authorized by password flow in IdentityServer4 located under WebApi1, so Spa1 have the JWT with "WebApi1" scope and refresh 
  token as well.</li>
  <li>John in Spa1 clicks the button "Go to Spa2" then he is rederected to Spa2.</li>
  <li>In John’s browser, a new page is opened with Spa2, and John sees that he is already authenticated by IdentityServer4 in Spa2 
  and authorized for WebApi2 (John can use Spa2 functionality without additional login dialog), becouse db2 has a mapping db1.users->db2.users (so webApp2 can use it's own roles).</li>
  </ol>
  
  <p>This is similar to the scenario when a user read a mail in gmail spa and from a letter follows the link to youtube (without additional auth actions)
  and sees that he is already authenticated by google.</p>
  
  <p>I wonted to use authorization code flow with config</p>
  
  <pre><code>new Client
  {
      ClientId = "app1,
      AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
      AccessTokenType = AccessTokenType.Jwt,
      ClientSecrets =
      {
          new Secret("secret1".Sha256())
      },
      AllowedScopes = { "api1"},
      AllowOfflineAccess = true,
      AlwaysSendClientClaims = true,
      AlwaysIncludeUserClaimsInIdToken = true
  },
  
  new Client {
      ClientId = "app2",
      ClientSecrets = 
      {
          new Secret("secret2".Sha256())
      },
      Enabled = true,
      AllowedGrantTypes = GrantTypes.Code, 
      RequireConsent = false,
      AllowRememberConsent = false,
      RedirectUris =
          new List&lt;string&gt; {
              "http://localhost:5436/account/oAuth2"
          },
  
      AllowedScopes = { "api2" },
      AccessTokenType = AccessTokenType.Jwt
  }
  </code></pre>
  
  <p>, but it requires additional authentication through the browser 
  <em>which is needless process</em> since the user already authenticated.</p>
  
  <p>How should i implement this auth scenario in IdentityServer4?</p>