Ahh that makes sense. And you are essentially correct. Generally speaking clients expect to be aware of who their IdP is, and currently Google/Facebook/Apple/Mi

Ahh that makes sense. And you are essentially correct. Generally speaking clients expect to be aware of who their IdP is, and currently Google/Facebook/Apple/Microsoft have a stranglehold on the "approved login IdP", with a few dark horses like GitHub. The original vision of OpenID (ie pre-OpenID Connect) was for applications to support any IdP, and you just tell the app what your IdP is when you create your account. You could also imagine browsers filling this in automatically. This didn't pan out in practice, primarily because no one used it[0]. However, it's becoming more realistic to run your own IdP, both by self-hosting and by using services such as Okta. Tailscale actually let's you bring your own OIDC IdP. It uses WebFinger to prove an IdP has authority over a specific identity (email address). This is even more streamlined than entering your IdP directly. You just give Tailscale your email and they automatically send your to your IdP to authenticate. But I wouldn't hold your breath for the major email providers to implement WebFinger so users can choose their own IdP. Which is one of many reasons I'm a big advocate of people using their own domain for email, even if the email itself is hosted by someone else (I use and love Fastmail). [0]: https://meta.stackexchange.com/questions/307647/support-for-openid-ended-on-july-25-2018 https://meta.stackexchange.com/questions/307647/support-for-... [1]: https://tailscale.com/kb/1240/sso-custom-oidc/ https://tailscale.com/kb/1240/sso-custom-oidc/