title: Password-less authentication using corporate Active Directory on external (internet) site
body: <p>I need to restrict access to an external site so that:</p>
  
  <ul>
  <li>users who are in the corporate network have full access to the site's functionality,</li>
  <li>those who are not - only limited functionality.</li>
  </ul>
  
  <p>In the corporate network users do authenticate against a windows domain. In the network I can set up a server/service which can do the identity verification. This is secure, I have no doubt, especially when it is inside. </p>
  
  <p>The external site is not a part of the domain.</p>
  
  <p>What I suggest to myself is to setup a service, which will authenticated users against, create a secure token and then re-direct users to the external site. So that users will authenticate there without entering password (maybe not even login). </p>
  
  <p>I'm in doubt: how this can be done? How secure this can be? How much heavy/crypto development are there? </p>
  
  <p>I assume that the secure token should be time-bounded, that both external site and internal auth service should support SSL/TLS (symmetric/asymmetric keys?). 
  Am I missing something here? Surely, I am, but what? </p>