I've a website built with ASP.NET, and uses Cookie based Forms Authentication to protect it self from unauthorized access.
It also has a REST based API which uses API key based Authentication. (Key is distributed separately).
We've a case where one of our customers want to embed certain pages from our site inside their own site (using an IFRAME). That customer will also have many other customers who authenticate with customer's site.
What are the best ways to authenticate these third party customers temporarily into our site? Are there any accepted patterns for this kind of scenarios?