Okay on one hand, I feel dumb for saying this, but on the other hand I’ve literally built SSO integrations this way, so…
What about OAuth2? I had very little issue building auth integration with both Okta and Google using OAuth, and storing the non-secret stuff about the user in my DB.