title: How would I implement single sign on, over the internet, using both OAuth and Active Directory
body: <p>OAuth is obviously a godsend when it comes to doing single-sign on, although there are doubtless headaches involved in merging different applications' user databases, but we also have a customer requirement to support Active Directory. Can anyone suggest any suitable architectures (or indeed resources/information on the web) for having multiple websites achieve single sign on, using both OAuth and Active Directory? It's conceivable that one domain could be set to be either one or the other, but the ideal would be that we cope with both (e.g. attempt AD auth and fallback to OAuth if not, perhaps?).</p>
  
  <p>We're a primarily Java-based development house, with rich-client web front-ends. We do use EC2 for some of our apps, but also host on our own servers. Ideally any solution would not care about the location of the application itself.</p>
  
  <p>All suggestions and opinions welcome.</p>