Comment by badusername

Seems like what you are describing is already possible by using single sign-on providers like onelogin and okta.