Quote:Original post by Kylotan
I'm not really asking how to do a specific thing, just wondering if there are ways I hadn't thought of. I'm also interested in what Site 2's API for authenticating a user to another site could be - if it involved you entering your Site 2 username and password into Site 1 then I can see that being unacceptable for many users.

There are a lot of so called "web 2.0" sites that do exactly that in order to work together with other social network sites. Usually it's just for one-time information copying so you could tell users that it's a one-time thing only and that they should change their password on site 2 after you're done.

But there are a lot of other possibilities. Think of it more as a site-specific OpenID-like construct. You could put a form (username only) or link on site 1 that takes you to a login page on site 2. After succesfull authentication on site 2, the user is redirected to a page on site 1. Something like:

<form method="post" action="http://site2.com/remote-authentication.html">    <input type="hidden" name="on-success" value="http://site1.com/success" />    <input type="hidden" name="on-failure" value="http://site1.com/error" />    <input type="text" name="site2-username" value="" /></form>

It would need some extra protection so that users can't simply read the page source and browse to http://site1.com/success directly, but it's simple and it works. From there on you could make it as complex as you want. But all these system require cooperation of site 2 for the specific purpose of remote authentication.