title: Is this a typical SSO flow and if not, what type of flow is this?
body: <p>I've taken over a legacy project and there's an SSO integration that <em>feels</em> weird to me.</p>
  <p>The flow of the application goes like this:</p>
  <ol>
  <li>user hits the site and is redirected to an authentication domain</li>
  <li>user logs in</li>
  <li>upon login, the site makes a request to my application and receives a token</li>
  <li>user is redirected back to my domain with the token in the url</li>
  <li>if the token is valid, they're allowed into the site</li>
  </ol>
  <p>It feels odd to me that there's a request to my application for a token. Wouldn't a typical flow require my app get a token from the Identity Provider?</p>
  <p>It almost feels like the previous team was implementing oauth or something similar. If this is a valid flow, is it called anything specific? Is there a better flow I should be using?</p>
  <p>Thanks</p>