Federated identity realms should be namespaced. It's fine to trust anyone, but provider A's "john.doe@example.com" should never equal provider B's "john.doe@exa

Federated identity realms should be namespaced. It's fine to trust anyone, but provider A's "john.doe@example.com" should never equal provider B's "john.doe@example.com". A provider should only ever have authority over its own users. This even applies to mainstream providers people (unfortunately) consider "trusted" such as Apple, Google or the social media networks, since their email ownership verification and security policies are different. If you are internally storing them in a flat table, an easy way is to just "salt" the username/unique account reference returned by the federated provider with the ID of the provider connection. That's a quick and easy way to ensure some non-federated-auth-aware code doesn't accidentally confuse two users with the same ID but originating from different auth providers.