If I have a common login service (login.example.com) under agreement that user information will not leave their environment. I would like to find a way to log the users in when they use a new client app, without having them select their environment. I hope for something better than having them round robin through all the environments till one lets them in.
I have two ideas:
- take hkdf of username and password. As those are known to both user and the backends, I can maintain a map of hash-> environment at login.example.com and use it without disclosing details about the users, save for the IP address.
- some multiparty computation
Is there another approach I should explore?