title: Keycloak (or another system) implemented composite IDP via automation/APIs to support large number of IDPs
body: <p>I would like to support hundreds of thousands of IDPs in my environment (for example 300k SAML 2 IDPs or OIDC OPs). If I was to get picky, I would like to support multiple protocols for authentication; SAML, SAML 2, OAuth, OAuth 2, OIDC but that isn't a strict requirement. Specifically, I want a login page on an IDP that supports authentication, password reset and SSO to SPs for each IDP stack, so to speak.</p>
  
  <p>To do this, I would like to be able to automate deployment and configuration of new IDPs using APIs. Additionally, I have a single identity store that would back all of these IDPs, hopefully retaining global uniqueness across usernames by leveraging the IDP (maybe name) as an additional differentiator. I'm thinking something conceptually like (IDP X Username) tuple. I would like each IDP to reuse a templated UI but have it's own API endpoints, keys, etc to support their respective flows securely. </p>
  
  <p>I'm not an expert in Keycloak and would like some advice on the mechanisms I can use in Keycloak to support this, if at all, and whether or not Keycloak could support this from a performance/volume perspective. I'm happy to write custom code/extensions, like UIs and storage integrations, but I would prefer to leave the identity management/IDP tasks to Keycloak where possible. I'm also assuming that deployment would not actually deploy a new artifact onto the network, it would just add new endpoints to a currently running Keycloak system but I would like validation of that assumption, if possible.</p>
  
  <p>Long story short, I would like all the IDPs to support the same authentication flows/interaction patterns but look like unique IDPs on the network while limiting the number of deployed software components.</p>
  
  <p>I'm happy to take pointers, like "this might work for you". I'm not really looking for a full design here.</p>