We have a database with pictures (amongst other things). We have a few apps that can connect to this database via a php webservice (send https requests to a php file to retrieve stuff from the db and write new stuff to the db).
Now a third party wants to work together with us. They have their own web portal where their users have to log in. Their users can see some basic data, and the idea is that their users that are also our users can see the pictures from our database from within their portal.
We are not going to give this third party access to our database, but we do want to expose the pictures, given that the user is logged in. So we have been brainstorming a bit and came to the conclusion that whatever way we are going to do this, it's going to be a huge potential security issue if we don't do it perfect.
We thought about creating another database and sync it every hour or so with our live database. Then we want to create another webservice, so the third party can access the data in this second database. But now there is still no way for us to make sure the user is actually logged in, we don't have access to the third party's database either, so we can't verify this.
Can anybody explain what we have to keep in mind for a project like this? Did we skip something? Is it even possible to do this 100% safe?