I am stumped at this problem.
Users authenticate at my client's website. Then the users see their profile page on my client's website. My client now wants me to provide a URL on their profile page, for his users, to download information from an external website. (This external website is not controlled by my client). That is to say, upon clicking this URL, it links out to an external website and gets a personalized file.
As the information is considered sensitive (not critical), the external website should not allow anyone to download the personalized file.
I'm stumped at figuring out how to allow only one authentication (on my client's website) instead of having the end users authenticating twice (once on my client's website and separately on the external website)