I have two web servers ServerA (LAMP stack) and ServerB (ASP.NET stack). I think the technology (hopefully) does not matter. Both servers require authentication and supposedly doing their job well, if not that is out of scope in this question.
I would like to implement a page with iframe content. ServerA serves the outer content ServerB serves the inner content (the iframe). The servers are in different domain. When user X logs to ServerA and navigates to the page, I would like to show a personal and sensitive content coming from ServerB in the iframe. The content belongs to user X's identity in server B.
- ServerA and ServerB has a shared secret (server side)
- Users are replicated from ServerA to ServerB. Usernames match, passwords on ServerB random generated and not used at all. (keep reading)
- ServerA authenticates the user via https using a form based authentication
- Outer page contains the following html fragement where the .any extension in the url is configured to execute and respond in the server for example .aspx or .cshtml or .php etc:
<img src="https://serverb.com/dummy.any?parameter=crypted_username_and_date_using_the secret" style="display:none;" />
In ServerB when a request received to the dummy.any url it decrypts the parameter, does some checking then in the response sets a crypted cookie containing with the username. The crypting key could be the shared secret or better it can be a ServerB's private secret.
In ServerB when a request received to the inner page (the iframe) it should contain the cookie, what was set for this very same domain (https://serverb) if the cookie is there and the userX is existing, and say a 5 minutes the timeframe is all OK, then ServerB uses its authentication subsystem to log on the user programmatically (no password provided). (the authentication subsystem sets their own cookies or whatever, this hopefully black box in our point of view)
- After this ServerB serves sensitive content which belongs to userX.
Please note I am a developer and not a security expert. That's why I am asking before implementing a security hole.