I need to log into Salesforce.com from company's website, where agents click a link to VF page in salesforce. I dont want to use SSO as I dont want to buy licenses for all agents. How is this possible if there is a HTTP post from Java, that contains AgentId+Token w/timestamp. We have to receive those details and send them back to Java for validation, if True allow login for agent and if False dont allow. What procedure/coding should I follow to fulfill this requirement without having to use any appexchange apps.