Can be done with a redirect through the authenticator domain that would then pass a token in a query parameter or something. Not as streamlined, but it works. Some oauth flows are already doing this exact thing.