title: how to do single-sign-on (SSO) between two web apps, PHP and Java EE?
body: <p>I have an existing Java EE web application running on GlassFish 3.1.  Sign in works fine through the jdbcRealm configured in GlassFish 3.1.</p>
  
  <p>Someone on another team is developing a separate web application in PHP, the boss doesn't want the user of the apps to have to sign in twice.  That is, when they are signed in to the Java web app and they click a link that takes them to the PHP app, they should already be signed in to that app as well.  (And vice-versa.)</p>
  
  <p>Not sure how to implement this.  I was thinking that I could generate a long random key (a token) that gets generated on log in of either app, and passed around in every web request for either app to identify a logged in user, but that doesn't seem safe.</p>
  
  <p>I need pointers in the right direction.</p>