security - SSO for two applications that use different identity providers -

i want perform sso between 2 web apps. here scenario:

apps & b (both provide restful api). app b uses form based authentication , can not make modifications app b. also, app , app b maintains different user stores authentication.

user registers in app , after registering, logs in app , calls api app b require user authentication.

the goal ensure once user logs app should able call authenticated api of app b without need logging in app b again.

i went through cloud based sso solutions provided pingidentity, stormpath , few other vendors , looks sso across multiple applications require either applications should trust same identity provider or apps should understand saml/open id. also, require me change way app b handles authentication (but can not make changes app b.

i have thought of simple solution scenario (which in way sso approach http://www.opengroup.org/security/sso/sso_intro.htm)

once user logs in app a, server make background login call app b (using pre-configured default credentials app b). in response login, app b issue session cookie passed in subsequent api calls app b. approach has drawbacks of using default credentials app b it's simple , work.

however, before going path, wanted know if scenario can handled in different way using standard sso solutions ?

traditionally, there "glue" binds sso applications together. there needs inherent trust between 2 applications. commonly done protocols (saml / open idc) or shared secrets (for validating signatures).

in scenario describing, have no control or access how app b authenticates, need authenticate "in background" app b , hold on session cookie subsequent requests.

however, inherently insecure. it's creating anonymous login app b using users of app a. far app b concerned, same user logging in.

if had ability create account in app b such each account in app had analogous account in app b logged in to, more secure.

hope helps!

full disclosure: work stormpath.