title: IdentityServer SSO - Trusted application
body: <p>I need to SSO (single sign on) a user coming from an application of mine (identity provider using ASPNET Session State) and redirect them to another application of mine (service provider) that is configured to use implicit flow with IdentityServer4.  I need to achieve this without requiring the user to log back in and without providing the user's password.</p>
  
  <p>My initial thought was that I could use a client secret for the identity provider to redirect the user to the IdentityServer4 authentication end point with the access token as a query parameter and then use a custom validator or extension grant to issue an identity token for use with the service provider application without needing to also provide the user's password.  </p>
  
  <p>I've managed to issue an access token to the identity provider and then redirect the user to IdentityServer4, but issuing an identity token has proven difficult for me.  I've poured over the samples and documentation and I'm confused to say the least. </p>
  
  <p>I'm looking for direction on the appropriate approach to this scenario and perhaps a comprehensive example in C#.  I've come to understand I can use a hybrid flow to issue an access token as well as an identity token. I think my biggest struggle is how to redirect the user and, based on the access token, issue the user an identity token (and if this is even an acceptable approach).</p>
  
  <p>Simply put: I'd like to redirect the user from Application A to IdentityServer4 to Application B based on trust with the identity provider (via client secret?).</p>
  
  <p>Note: I understand this could be considered an opinion-based question, but based on my research I believe there is one single best practice and that's what I'm asking for.</p>