Isn't OpenID Connect supposed to solve this? (don't know if it actually delivers though)