I had been bouncing my head off of this for awhile as we wanted to allow an automous service scrape a webpage to make PDFs using non Salesforce PDF generation.  We tested using a session ID created on Force, which worked great.  Then when we tried to do it dynamically from the apex code it failed because session IDs from Force vs Apex are NOT the same.  So we tried oAuth.  Which works great until you try and use the password/user flow which is apparently NOT allowed to access web page resources.  You have to use an interactive flow, like refresh token to access web pages.  That was no good since we are running as a service.

The solution : Get an access token via SOAP : https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_calls_login.htm

You can slot the access token id you get from the soap login into your frontdoor.jsp call.  

        public TokenResponse GetSoapTokenResponse()
        {
            TokenResponse token = null;

            var username = System.Configuration.ConfigurationManager.AppSettings["SF.Username"];
            var password = System.Configuration.ConfigurationManager.AppSettings["SF.Password"];
            var securitytoken = System.Configuration.ConfigurationManager.AppSettings["SF.SecurityToken"];

            SforceService binding = new SforceService();

            LoginResult lr = null;
            try
            {
                lr = binding.login(username, password + securitytoken);
                token = new TokenResponse();
                token.instance_url = lr.serverUrl;
                token.access_token = lr.sessionId;
                token.id = lr.userId;
            }
            catch (Exception e)
            {
                throw (new Exception("Could not authenticate via soap : " + e.Message, e));
            }
            return token;

        }
        public string CreateSoapAuthenticatedUrl(string returnUrl)
        {
            var token = GetSoapTokenResponse();
            string baseURL = System.Configuration.ConfigurationManager.AppSettings["SF.FrontdoorUrl"];  
                       // "{0}/secur/frontdoor.jsp?sid={1}&retURL={2}" is what this pulls in.
            string instance = token.instance_url.Remove(token.instance_url.IndexOf("/services"));
            string url = string.Format(baseURL, instance, token.access_token, Uri.EscapeDataString(returnUrl));

            return url;
        }
        public class TokenResponse
        {
            public string id { get; set; }
            public string issued_at { get; set; }
            public string refresh_token { get; set; }
            public string instance_url { get; set; }
            public string signature { get; set; }
            public string access_token { get; set; }
        }