My company owns a domain A.com , and subsdiary is on B.com
B.com redirects their users to A.com for accounts registrations. Post successfull registration , A.com logins that user ( User doesnt get to know this), creates a token and needs to pass that token to B.com so that B.com shows that user logged in.
What should be the correct way to pass this information to B.com as we cannot write cookie for them.
I was thinking of encrypting the token , and A.com and B.com decide the encyption to use. But are there any other better approaches to deal this issue ?