Designing the flow of OAuth2 authentication
<p>I am trying to come up with a proper OAuth2 authentication flow for a parent/child relationship.<br/>
App-A and App-B are two independent applications. <code>App-A</code> opens up <code>App-B</code> in an iframe when clicks on a link from <code>App-A</code>. </p>

<p>I am responsible for maintaining <code>App-B</code>.<br/>How can I design the flow in a way so that <code>App-B</code> recognizes users coming from <code>App-A</code> and keep the same session across both the applications?</p>

<p>This is the flow I have come up with so far:</p>

<ol>
<li><p><code>App-A</code> will provide a client-id and secret-key to <code>App-B</code> before the interaction.</p></li>
<li><p>User makes a request to <code>GET /person</code> endpoint of <code>App-B</code> with a <code>parentId</code>.</p></li>
<li><p><code>App-B</code> will then sends a request to <code>App-A</code> server with client-id, secret-key and <code>redirect-url</code> set as <code>GET /person</code>.</p></li>
</ol>

<p>Now what <code>App-A</code> will send to <code>App-B</code> to pass the session info of authenticated user.</p>

<p>If the flow doesn't make sense, you can get rid of it</p>