I\'m building an ecosystem of applications under a common domain, with each application under a separate subdomain. I have built an authentication application for the ecosystem
I would suggest a custom module which gets data from a database based on who logged in, this way you manage from a central point and can set whatever you want based on whatever is in the database, from the other side you synchronize the database with authentication sources.
A client always has the same login interface, nginx always communicates with the same authentication source in the same way, you only need to manage the database and its interfaces to the authentication sources.
client <> nginx <> database <> set values where client is going and is allowed to do.