title: How to use OpenID or OAuth for internal first-party authentication?
body: <p>I am working on an internal authentication system for users of a set of of RESTful web applications.  Our intention is that a user should be able to sign-on once via a web form and have appropriate access to all these RESTful applications in our domain, which may be distributed in a private cloud across many servers.  (I understand already that having a single authenticated session is not aligned with a pure RESTful approach, but this is a usability requirement.)  </p>
  
  <p>The applications themselves will be written in a variety of programming languages so a language-neutral approach is required.  It was suggested to me that we might use OpenID or OAuth or a similar framework to handle the authentication but my understanding is that these are intended for third-party services and not the first-party services that would share data on our internal system.  In this case, we might have a central provider service with all the other applications treated as third parties (or relying parties).</p>
  
  <p>Questions:</p>
  
  <ol>
  <li>Are OpenID/OAuth suitable for authentication among first-party services?</li>
  <li>If so, how would one be advised to set up authentication for this use case?</li>
  <li>Wouldn't a user have to grant individual permission to each first-party server that they wanted to use, just as they would need to grant individual permission to any third-party server?  I think this would violate the requirement of having a single sign-on for accessing all the first-party services.</li>
  <li>Are there good examples of sites supporting this first-party use case?</li>
  <li>What would be a good alternative framework for this first-party use case?</li>
  </ol>