I'm tasked with migrating a group of .Net WebForms applications from a current custom username/password login scheme to an oauth2/openid connect based authentication and authorization. This specific application is very mature and broad. As a result, the goal is to change as little of the underlying infrastructure as possible.
Currently, users log in with a username and password combination. Many people have more than one username/password combination. We want to change this to an email/password combination instead. I have an IdP set up to do authentication this way that can provide an id token. I think this part is relatively straightforward.
The wrinkle comes from the multiple accounts that each user currently has. Because of the nature of the applications, I need to support the multiple accounts, linked together through the email address.
Would it make sense to have a second IdP which can provide the list of accounts linked to the email address that can then provide a token based on the account chosen? If so, what is the best way to provide the email address to this second IdP?
Thanks for any insight.