Given two companies managing two separate websites, the client wants the user to be able to log in to one website, and then click a link to navigate to a certain part of the second website. The client wants to eliminate the need to log in a second time upon arriving on the second website.
I'm thinking the solution is
Rather than linking directly to the second website, link to a redirect page within the first site.
The redirect page would generate a random string, and notify the second website what the random string is, and which user ID and IP address it is for.
The user would be redirected to the second website with the random string included in the URL.
The second website would check the random string + IP + date/time.
Once validated, the second website would initialize a login session giving the user appropriate access.
Caveats I am aware of are
The second website's security is limited to that of the first website.
If the user logs out of one site, they would not automatically be logged out of the other one.
So my question is
Is this solution a good one, would it be secure if properly implemented?
Is there another obvious/better solution I should be reviewing?
Please let me know if there are any other caveats I should know of, or things to watch out for during implementation.
Using something like oauth would probably be easier and safer. The main issue with it is that you can't use the user password for user level encryption, but if that isn't needed by the site the user isn't logging in to directly, then you are fine.
You have the basic idea right, in that you want the one server to be responsible for the login and the other to trust that server, but I would suggest that you want a system that relies on trusted communication between the two servers rather than a string to validate the session. That's basically the idea with oauth, where the one system has the other system process the login and return a validation that the user authenticated. You could hide the oauth process because the user is already logged in to the site that will validate their identity, so it could be done behind the scenes.