I've also worked with SAML and OIDC as an architect, and implemented OAuth (relatively trivially) for websites, and SAML is not a solution that can be considere

I've also worked with SAML and OIDC as an architect, and implemented OAuth (relatively trivially) for websites, and SAML is not a solution that can be considered naively. The problem SAML solves is if you would like to stand up a federated IdP, or integrate to an existing federation that uses SAML. If you don't know what these mean, I'd argue you are blessed, and it's not a problem you have. I will say that many enterprise/institutional applications are simple CRUD web pages with gargantuan iceberged identity management problems that developers and project managers walk right into. Identity is a basic unanswered business model question that shouldn't be left to last minute implementation decisions. If you are building a consumer service today, I don't see why you would bother having your own password database or authentication scheme when you can just adopt any of the major platforms as an IdP using OAuth. Storing passwords today is dumb. I'd argue if you do not want to adopt an IdP and use their OAuth or OIDC service, stand up a Vault instance and use it for TOTP secrets for users 2FA apps. They are literally better user experiences than trying to remember a never-used password. If you need to do enterprise 2FA, Authy and Google Authenticator and now Apple's Sign-In and Relay services are great options. Keycloak is another cool package for handling OAuth and OIDC services as well.