We currently have requirement to show external website in iframe. External website users will have user name and password and salesforce user name and password as well.As part of the authentication i am sending loggedin user salesforce session id in the iframe url parameter. Now the question using this session id can the external system grant access to 3rd party website by doing callback to salesforce and get the user information? Kindly help..
Answering to the question:-
Now the question using this session id can the external system grant access to 3rd party website by doing callback to salesforce and get the user information?
Yes, if external site can read the session Id and has the url of the instance then it can call the Salesforce and perform tasks based on user.
Iframe witin Salesforce page comes under Cross-Origin policy violation. It means you can not access a website url within Salesforce which has different domain, protocol and port. So, this solution may not work.
I recommend to use Connected Apps.
Update as per comment:-
You will need to configure external website to match the Username and Org Id registered in external site database. If information received from session ID matched with website database process the automatic logic
Other recommended way:-
Set up the IDP (Identity provider) and single sign-on. This is the most common way to authenticate two systems and verify their credibility. Go through these links and try t0 understand the single this process. You may find several post how we can leverage this feature.