title: How to integrate two disparate websites with a common login without exposing passwords?
body: <p>I have a website, call it "Site One" in which users create accounts with a username and password. For security, I then salt and hash the user's password and store it in a SQL Database. It all works great.</p>
  
  <p>Now enter "Site Two" which is written by a different company. We would like to integrate the two apps so that if a user is logged into Site Two, they would be able to:</p>
  
  <ol>
  <li>Create an account on Site one through a Web API.</li>
  <li>Have a one click seamless login from Site Two back to Site One.</li>
  </ol>
  
  <p>Is this achievable without Site Two being able to Store and Retrieve the password from the user account that they created?  The only way I can think of this working is that after Site Two makes the WebAPI call to Site One to create an account, Site Two would have to be able to store the password which was used to create that account in the first place, thus opening a big security hole in case someone was able to get a hold of the password.</p>
  
  <p>I supposed as an added security layer, I could prevent that password from being used except when the login info is posted from a known IP address, but I'm not sure if this is enough protection.</p>