Hi Rahil,
What kind of application are you talking about?
If this is a server-side application then you would usually do this by putting it behind the Reverse Proxy and have it use the "External Authentication Interface (EAI)" to be able to assert user identity to the Reverse Proxy. This is how our own AAC and Federation runtimes log a user in. Using EAI means that the application sends HTTP Response headers which assert the user identity to the Reverse Proxy.
If you're talking about a client-side application (a mobile app for example) then you need to stop and think what you're asking here. The ability to create an authenticated session from just a username is an extremely trusted operation but any client-side application is inherently untrusted. These two things just don't go together.
Usually the only way that a client-side application is able to assert user identity for a session is by using some secure key (a private key or shared secret) which has been previously registered on that device and associated with the user account. The level of trust is different here; the app isn't able to assert any user - only then one that is registered.
I hope this helps. If I misunderstood you requirement, please let me know.
Jon.
------------------------------
Jon Harry
Consulting IT Security Specialist
IBM
------------------------------