Hey, I got it working for me. I tried to outline it here: Authenticate against 3rd Party User Database - #5 by marcus-at-localhost
I’ve based the login flow on GitHub - kerli81/kirby-securedpages: Protect pages for authenticated users and wrote an Uniform Action, that handles the auth against the 3rd Party API and creates a Kirby User Object in a Session.
And then I had to overload the Kirby Object to look for Kirby Users in the session object and merge with the physical Kirby Users.
This way I don’t pollute the Kirby Users DB with 3rdParty Users and be flexible with other API based auth services.
It feels a bit hacky though.
I haven’t gotten any feedback on this approach from the community, but as a Proof of Concept, it works alright for me.