Single sign-on for members-only portals

We run a members-only community portal for our customers. Email sign-in with a code works, but our customers already have accounts in our app, and asking them to sign in again feels clunky.

It would be great to sign people into the portal with our existing identity provider (SAML or OpenID Connect), so anyone logged into our app lands in the community already signed in, with access decided on our side.