I have 100 domains with authentication backed by the same LDAP database. There is a single-sign on, but it's not implemented with OAuth. That is to say, per user, each domain accepts the same user/password credential for authentication.
Under the normal workflow with something like Chrome, the user would be forced to copy-paste that user/password into multiple sites, creating multiple entries in the browser's password-manager. Each time, the burden is on the user to check to make sure they're copying the password into a "safe" site. On password-change, it's the user's job to update the password on each site
After having entered in the same username and password on 99 sites, the hundreth could reasonably be a bad site, and it's largely a numbers game. I would like to have the ability to establish a list of sites for the credentials to be valid for early on.
This would mean after the user logs into to a site once, they would no longer know what sites they can apply those credentials too.
What is the best way to secure a client against phishing attacks where single-domain OAuth is not a solution and a login is shared across sites?