Identity federation: OpenIDConnect (Keycloak, AzureAD...)