It sounds like you can design a login provider around that: direct to login site with a return address, confirm with user they want to log in, post back to return address with token that allows site to query login provider.