Well in our case we have multiple fundraising tools provided by a myriad of vendors (greater than 10). These tools vary in architecture (e.g. SaaS, PaaS, Turnk

Well in our case we have multiple fundraising tools provided by a myriad of vendors (greater than 10). These tools vary in architecture (e.g. SaaS, PaaS, Turnkey, etc) and age. We also have a number of in-house developed products. We also have training resources that are exposed in different ways from Salesforce Communities to LMS based training systems. Our fundraisers and constituents as a whole have access to these tools to interact with us. Some of the products are self service, others require authorization. All of them are branded and the users consider that they're interacting with us and not the underlying product. So we have a situation where we need to Authenticate a user and possibly authorize them to access tools with varying roles and degrees of access. If a user needs access to Tool A but can't until they've completed training in the LMS, we have a situation where we need to identify and track a user across disparate platforms. It's not unlike having a Microsoft Account shared across Azure, DevOps, Office 365, and TechNet. Or a single Google Account to access Drive, Developer APIs, and Gmail.