SSO process - An acceptable solution?
<p>I need to implement a Single Sign On process for a site.  I'll refer to Site A as the site with the Sign on screen and site B as the site that needs to Auto sign on.  The two sites are on different domains and I do not have any control over site A.  But I need to suggest ideas for the process.</p>

<p>After some reading I have this suggestion.  Site A passes a ticket in the query string to site b.  Something like SiteB.aspx?Ticket={guid}.  This ticket must be a one time valid value that will be managed by Site A.  My site (Site B) will pass the Ticket back to site A in the form of a web service call.  The response from this call if the ticket is valid will contain an account ID that I can use to auto log in.  </p>

<p>Does this seem an acceptable solution?  Site B will be under HTTPS.  Would passing the Ticket in the query string be secure or would the Ticket be best passed as an additional header?  Would the ticket still need to be encrypted if under https?</p>
