Let's say you can get the site on the same domain or work out a way to hand off some kind of authentication token. You don't necessarily need a ghost WordPress installation on the second site.
I'm working on a WordPress site now that complements an existing, non-WordPress site. One of the requirements of the project was that authentication be handled through the non-WordPress site. I created a plugin that bypasses typical WordPress authentication for the WP side.
The plugin has a function attached to the WP init action that when the visitor is not logged in to the WP site and the external auth cookie is present, grab the token and call a service on my non-WP site to validate the token. If the token validates, I force a login for the username the validating service returns to me. From that point on the user is logged in to the WordPress site and no further validation is performed against the external site. If the user does not yet exist for the given username in WP the plugin creates it.
There's some other code in there to redirect to the external site login page instead of the standard WP login.