I had pretty good experience with building authentication/identity providers with Doorkeeper in Rails. Your clients would then use Omniauth or the Oauth2 directly to login via that provider. I'm boarding a plane right now, so that pulling those projects up for you is a bit tedious but just google them. Cheers!