I've been struggling to find very simple, low level explanations of federated authentication protocols. Previously I've seen SAML and oauth, but they both seem to be very high level and far more complex than just authenticating a simple server. I've come up with a rough idea of how it could work but I don't know if I've got it right.
For example, user [email protected] wants to log in to server z.com. Let A denote the client computer and a.com A's "homeserver".
Initially, A logs in to a.com using a username and password. When A wants to log in to z.com, it sends a message like "hello I'm [email protected]". Server z.com then contacts a.com, asking for a token (some unique unguessable bytes) which a.com also sends to A. Then A sends the token it was sent to z.com also, and z.com checks that the tokens match. This way, z.com knows that A is authenticated with a.com without needing to know the password.
What are the problems with this approach? How can I learn more about how federation is done in practice?