Arguably, OAUTH2 + OIDC does this. Firms like Atlassian have understood this:
http://id.atlassian.com