> Basically the user is doing a slightly special login to site B. Instead
> of passing username and password it passes username and the id of the
> site they are currently logged onto. Site B can then call that site to
> check this is true instead of checking the password itself.

If I don't misunderstand it I think it is not very secure... If
someone logs onto Site A, and when hi is still there I use his
username and site_id (which is the same for all) to go to another
site, I am authenticated?


--
Ksenia