Well when I tried this with Auth-O a few years ago, they provide a JS login widget than can then handly auth and user management on Auth-o's system and return the signed JWT to the user.