I'm wondering if it's possible to deal with a login mechanism that is dependent on the user identifier.
For example, the user can have access using OpenId, OAuth or token. But how can we "help" the user to determine which mechanism they can use?
For the moment the rest of my team want to expose the auth mechanism after the user gives the username to help to choose the right authentication mechanism.
For me, this is a bad idea, because someone can guess the validity and get info about a user without entering the password. But maybe there is a way to do it?
One option is to use email as "gate". The user needs to click to a link in his email to get the proper login mechanism.